Executive brief
A security vulnerability exists in the Simple IT Discussion Forum, a web-based platform for community discussions. An attacker can inject malicious scripts into the forum's category management page, which could allow them to steal user session information or perform unauthorized actions on behalf of other users. This occurs because the software does not properly verify or clean information entered into the category fields.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in code-projects Simple IT Discussion Forum 1.0 within the /edit-category.php component. The root cause is the improper neutralization of user-supplied input in the 'Category' parameter, which is echoed back to the user without sufficient validation or output encoding. A remote, unauthenticated attacker can exploit this by tricking a user into clicking a specially crafted link, leading to the execution of arbitrary JavaScript in the victim's browser context. This can result in session hijacking, cookie theft, or unauthorized actions. A proof-of-concept exploit has been publicly disclosed.
Affected products
- code-projects Simple IT Discussion Forum 1.0
Timeline
- 2026-03-25: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-04-09: advisory: CVE published