Executive brief
Simple IT Discussion Forum is a web-based application for hosting community discussions. A security flaw in the administrative user management interface allows an attacker to inject malicious scripts. If an administrator views the affected page, the attacker could potentially perform unauthorized actions or steal session information, though the attack requires specific administrative privileges to initiate.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in code-projects Simple IT Discussion Forum 1.0 within the /admin/user.php component. The root cause is the improper neutralization of user-supplied input in the 'fname' parameter, which is subsequently rendered in the administrative interface without adequate encoding or filtering. An attacker can exploit this by submitting a malicious payload (e.g., via the registration page) that executes when an administrator visits the user management page. While the vulnerability is reachable over the network, successful exploitation typically requires high privileges or specific user interaction to trigger the script execution. A public exploit has been disclosed.
Affected products
- code-projects Simple IT Discussion Forum 1.0
Timeline
- 2026-04-01: disclosed: Initial disclosure on GitHub issues
- 2026-04-10: advisory: NVD publication date