CVE-2026-6160

MediumCVSS 5.3

Published: 13/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

24th percentile - higher than 24% of all known CVEs

Summary

A vulnerability in code-projects Simple ChatBox 1.0 affects the SimpleChatbox_PHP function in the chatbox.sql file (Endpoint component). Manipulation leads to file and directory information exposure. The attack can be performed remotely, and the exploit has been publicly disclosed.

Risk Assessment

An attacker can remotely obtain information about file and directory structure, which may facilitate further attacks. The public exploit increases the risk of exploitation.

Recommendation

Update Simple ChatBox to a version containing the fix or remove/restrict access to the chatbox.sql file. Restrict network access to the application.

Other vulnerabilities in Simple ChatBox

CVE-2026-6159Medium
A vulnerability was found in code-projects Simple ChatBox up to 1.0 in an unknown function of /chatbox/insert.php (Endpoint component). Manipulation of the 'msg' argument leads to cross-site scripting. The attack can be performed remotely, and the exploit has been publicly disclosed and may be used.

Original NVD description (English source)

A vulnerability was found in code-projects Simple ChatBox 1.0. Affected by this issue is the function SimpleChatbox_PHP of the file chatbox.sql of the component Endpoint. Performing a manipulation results in file and directory information exposure. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS