Description
A security vulnerability has been detected in code-projects Simple IT Discussion Forum 1.0. This issue affects some unknown processing of the file /admin/user.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Published: 2026-04-10
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Patch
AI Analysis

Impact

An unsanitized processing of the fname argument in the /admin/user.php page has been exposed, allowing attackers to inject arbitrary scripts into the browser context when the page is accessed. The vulnerability can be triggered remotely and has publicly disclosed exploitation code. This leads to cross‑site scripting, potentially enabling data theft or session hijacking for any user viewing the affected page.

Affected Systems

The identified affected product is code‑projects Simple IT Discussion Forum version 1.0. The vulnerability resides in the /admin/user.php endpoint and impacts that single release level of the forum application.

Risk and Exploitability

With a CVSS score of 4.8 the risk is moderate. No EPSS data and the vulnerability is not listed in the CISA KEV catalog, indicating it is not currently known to be actively exploited, but the remote attack vector allows any attacker to craft a request and trigger XSS. Absence of a published patch means the risk could persist until a vendor update or mitigation is applied.

Generated by OpenCVE AI on April 10, 2026 at 03:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check the code‑projects vendor site for an available patch or updated version of the Simple IT Discussion Forum and apply it immediately.
  • If no patch is released, restrict access to the /admin/user.php page through network controls or firewall rules to limit exposure to trusted internal users only.
  • Implement server‑side validation and output encoding for the fname parameter to neutralize script payloads before they are rendered.
  • Monitor site logs for unexpected script execution attempts and consider using a web application firewall tuned to block XSS patterns.

Generated by OpenCVE AI on April 10, 2026 at 03:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Apr 2026 04:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Apr 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects simple It Discussion Forum
Vendors & Products Code-projects
Code-projects simple It Discussion Forum

Fri, 10 Apr 2026 02:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in code-projects Simple IT Discussion Forum 1.0. This issue affects some unknown processing of the file /admin/user.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Title code-projects Simple IT Discussion Forum user.php cross site scripting
Weaknesses CWE-79
CWE-94
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Simple It Discussion Forum
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-14T03:17:51.899Z

Reserved: 2026-04-09T13:23:44.725Z

Link: CVE-2026-6003

cve-icon Vulnrichment

Updated: 2026-04-14T03:17:44.438Z

cve-icon NVD

Status : Deferred

Published: 2026-04-10T03:16:04.497

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-6003

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-10T09:27:02Z

Weaknesses