CVE-2026-6003

LowCVSS 2.4/10Last modified Oct 26, 2026

Description

A security vulnerability has been detected in code-projects Simple IT Discussion Forum 1.0. This issue affects some unknown processing of the file /admin/user.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
code-projects	Simple IT Discussion Forum	1.0

References

Timeline

Published: Apr 10, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-600308.7Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page CVE-2026-600316.9Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vuln CVE-2026-600329.4Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 - The Joomla extension JMedia is vulnerable to an CVE-2026-600335.1Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to an S CVE-2026-600349.4Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to a st CVE-2026-600357.2A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can res CVE-2026-600367.2A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code execution. This can r CVE-2026-600377.2A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution.CVE-2026-600387.2A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function leading to code execution. Thi CVE-2026-600397.2A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execution. This can r CVE-2026-60047.3A vulnerability was detected in code-projects Simple IT Discussion Forum 1.0. Impacted is an unknown function of the file /delete-category.p CVE-2026-600407.5An unauthenticated remote attacker can perform a DoS in the backends backup creation function. This can result in a total loss of availabili