CVE-2026-6159

19th percentile - higher than 19% of all known CVEs

A vulnerability was found in code-projects Simple ChatBox up to 1.0 in an unknown function of /chatbox/insert.php (Endpoint component). Manipulation of the 'msg' argument leads to cross-site scripting. The attack can be performed remotely, and the exploit has been publicly disclosed and may be used.

The publicly disclosed exploit enables remote script injection, potentially leading to session hijacking or actions performed in users' context. The risk is elevated because the vulnerability is easy to exploit.

Implement input validation and encoding for the 'msg' argument in /chatbox/insert.php. Consider restricting access to the application until the vendor provides a fix.