What is the CVSS score of CVE-2026-6003?

CVE-2026-6003 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-6003?

Yes, a public proof-of-concept exploit is available for CVE-2026-6003. Prioritise patching immediately. EPSS: 0.0%.

Simple It Discussion Forum CVE-2026-6003

EUVD-2026-21284 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-10 VulDB

PHP XSS Simple It Discussion Forum Code Projects

1.9

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	Despite the CVSS score of 2.4, real-world risk remains constrained by multiple mitigating factors present in the attack profile. The CVSS vector (PR:H/UI:R) indicates the attacker must possess high administrative privileges and trick a user into clicking a malicious link, significantly reducing exploitability compared to unauthenticated network attacks. The EPSS probability and other signals are not quantified in available data, but the public exploit availability (POC) confirms the technical feasibility. The CVSS E:P (Exploit Code Maturity: Proof of Concept) tag and low base score together suggest this is primarily a lateral-damage or privilege-abuse risk rather than a critical attack vector. Organizations with strong administrative access controls and user training may deprioritize this relative to higher-impact vulnerabilities.
Exploit ScenarioDerived	An attacker with administrative credentials (or who has compromised an admin account) crafts a malicious URL containing JavaScript in the fname parameter, such as /admin/user.php?fname=<script>alert('XSS')</script>. The attacker then tricks another administrator or forum moderator into clicking the link via email or chat. When the victim visits the link, the unescaped fname value is reflected in the HTML response, causing the embedded JavaScript to execute in the victim's browser session with admin-level permissions, potentially allowing session hijacking or unauthorized administrative actions. Publicly available exploit code (referenced in the GitHub issue) demonstrates the basic injection technique, though exploitation requires both admin access and user interaction.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 10, 2026

Stored cross-site scripting (XSS) in code-projects Simple IT Discussion Forum 1.0 allows authenticated remote attackers with administrative privileges to inject malicious scripts via the fname parameter in /admin/user.php, affecting user interactions through reflected XSS. The vulnerability has a CVSS score of 2.4 but carries a public exploit, though the low CVSS reflects the requirement for high-privilege authentication and user interaction to trigger the payload.

RemediationAI

Apply the latest patched version of Simple IT Discussion Forum from code-projects; exact fix version numbers are not specified in available advisories, so administrators should check code-projects.org for the newest stable release. In the interim, implement input validation and HTML entity encoding on the fname parameter in /admin/user.php to neutralize XSS payloads. Additionally, enforce Content-Security-Policy (CSP) headers to mitigate reflected XSS impact, and restrict administrative access to trusted IP ranges or require multi-factor authentication to reduce the likelihood of admin-level exploitation. Refer to the VulDB record at https://vuldb.com/vuln/356559 for updated remediation guidance and vendor statements.

Affected VersionsENISA

Simple IT Discussion Forum 1.0

Affected Packages

euvd simple_it_discussion_forum no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This is a CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting) vulnerability in a PHP-based forum application. The vulnerability exists in the /admin/user.php file where user-supplied input from the fname parameter is not properly sanitized or escaped before being reflected in HTML output. The Simple IT Discussion Forum is a lightweight PHP application (CPE: cpe:2.3:a:code-projects:simple_it_discussion_forum:*:*:*:*:*:*:*:*), and the lack of input validation on the fname field allows attackers to embed arbitrary JavaScript that executes in the context of an administrator's browser session.

Know when Simple It Discussion Forum gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

High

User Interaction

Passive

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

Low

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

PoC Detected

Apr 10, 2026 - 03:16 vuln.today

Public exploit code

CVE Published

Apr 10, 2026 - 02:15 nvd

MEDIUM 4.8

DescriptionCVE.org

A security vulnerability has been detected in code-projects Simple IT Discussion Forum 1.0. This issue affects some unknown processing of the file /admin/user.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

Threat Intelligence Overview

EPSS Score

0.0%

Top 91% exploitable

Exploit

POC

Public exploit code exists

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.