CVE-2026-6159
code-projects Simple ChatBox Endpoint insert.php cross site scripting
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
9th
A vulnerability has been found in code-projects Simple ChatBox up to 1.0. Affected by this vulnerability is an unknown functionality of the file /chatbox/insert.php of the component Endpoint. Such manipulation of the argument msg leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
| CWE | CWE-79 CWE-94 |
| Vendor | code-projects |
| Product | simple chatbox |
| Published | Apr 13, 2026 |
| Last Updated | Apr 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for code-projects simple chatbox
Be the first to know when new medium vulnerabilities affecting code-projects simple chatbox are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
code-projects / Simple ChatBox
1.0
References
vuldb.com: https://vuldb.com/vuln/357039 vuldb.com: https://vuldb.com/vuln/357039/cti vuldb.com: https://vuldb.com/submit/796666 github.com: https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Simple%20Chatbox%20PHP%20msg%20Parameter.md code-projects.org: https://code-projects.org/
Credits
🔍 AhmadMarzook (VulDB User)