Is there a public PoC exploit available for CVE-2026-6003?

Yes, a public proof-of-concept exploit is available for CVE-2026-6003. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6003

Q: What is the CVSS score of CVE-2026-6003?

CVE-2026-6003 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21284 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-10 VulDB

PHP XSS Simple It Discussion Forum Code Projects

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

PoC Detected

Apr 10, 2026 - 03:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 02:45 euvd

EUVD-2026-21284

Analysis Generated

Apr 10, 2026 - 02:45 vuln.today

CVE Published

Apr 10, 2026 - 02:15 nvd

MEDIUM 4.8

DescriptionCVE.org

A security vulnerability has been detected in code-projects Simple IT Discussion Forum 1.0. This issue affects some unknown processing of the file /admin/user.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

AnalysisAI

Stored cross-site scripting (XSS) in code-projects Simple IT Discussion Forum 1.0 allows authenticated remote attackers with administrative privileges to inject malicious scripts via the fname parameter in /admin/user.php, affecting user interactions through reflected XSS. The vulnerability has a CVSS score of 2.4 but carries a public exploit, though the low CVSS reflects the requirement for high-privilege authentication and user interaction to trigger the payload.

Technical ContextAI

This is a CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting) vulnerability in a PHP-based forum application. The vulnerability exists in the /admin/user.php file where user-supplied input from the fname parameter is not properly sanitized or escaped before being reflected in HTML output. The Simple IT Discussion Forum is a lightweight PHP application (CPE: cpe:2.3:a:code-projects:simple_it_discussion_forum:*:*:*:*:*:*:*:*), and the lack of input validation on the fname field allows attackers to embed arbitrary JavaScript that executes in the context of an administrator's browser session.

RemediationAI

Apply the latest patched version of Simple IT Discussion Forum from code-projects; exact fix version numbers are not specified in available advisories, so administrators should check code-projects.org for the newest stable release. In the interim, implement input validation and HTML entity encoding on the fname parameter in /admin/user.php to neutralize XSS payloads. Additionally, enforce Content-Security-Policy (CSP) headers to mitigate reflected XSS impact, and restrict administrative access to trusted IP ranges or require multi-factor authentication to reduce the likelihood of admin-level exploitation. Refer to the VulDB record at https://vuldb.com/vuln/356559 for updated remediation guidance and vendor statements.