What is the CVSS score of CVE-2026-6159?

CVE-2026-6159 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-6159?

Yes, a public proof-of-concept exploit is available for CVE-2026-6159. Prioritise patching immediately. EPSS: 0.0%.

Simple Chatbox CVE-2026-6159

EUVD-2026-21852 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-13 VulDB

GHSA-hh82-cfxx-fmf9

PHP XSS Simple Chatbox Code Projects

2.1

CVSS 4.0 · Vendor: VulDB

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Attacker crafts XSS payload
Delivery

Sends malicious msg parameter to insert.php
Exploit

Server stores unsanitized input
Execution

Victim views chat message
Persist

JavaScript executes in victim browser
Impact

Attacker steals session or credentials

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS 5.3 with AV:N/AC:L/PR:N indicates remote, unauthenticated, low-complexity attack with user interaction required. The integrity impact (VI:L) reflects potential session hijacking or credential theft through malicious script injection. EPSS score indicates publicly exploitable condition confirmed by presence of public exploit code (E:P tag in CVSS). While CVSS base score is moderate, the combination of remote vector, no authentication requirement, and public POC availability elevates practical risk for unpatched deployments. The user interaction requirement (UI:P) mitigates some scenarios but does not eliminate risk in social engineering contexts. Priority should be high for internet-exposed instances of Simple ChatBox.
Exploit ScenarioDerived	An attacker crafts a malicious chat message containing JavaScript payload in the msg parameter (e.g., <script>alert('XSS')</script>) and sends it to /chatbox/insert.php. When other users view the chat or when a moderator reviews messages, the injected script executes in their browser context, potentially stealing session cookies, stealing credentials, or performing actions on behalf of the victim user. Public exploit code on GitHub demonstrates the exact injection technique required.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 13, 2026

Cross-site scripting (XSS) in Simple ChatBox up to version 1.0 allows remote attackers to inject malicious scripts via the msg parameter in the /chatbox/insert.php endpoint, with user interaction required. The vulnerability has publicly available exploit code and affects the PHP-based chat application component. Impact is limited to integrity of user sessions, but the attack vector is remote and requires no authentication.

RemediationAI

Upgrade Simple ChatBox to a patched version if available from code-projects.org. If no newer version is released, implement server-side input validation on the msg parameter by rejecting or sanitizing HTML special characters, and apply output encoding using htmlspecialchars() or equivalent PHP functions when displaying chat messages. Additionally, implement Content Security Policy (CSP) headers to restrict inline script execution. Consult https://vuldb.com/vuln/357039 for additional vulnerability details and vendor advisories.

Affected VersionsENISA

Simple ChatBox 1.0

Affected Packages

euvd simple_chatbox no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Simple ChatBox is a PHP-based chat application component vulnerable to reflected or stored cross-site scripting (CWE-79) due to insufficient input validation and output encoding in the insert.php endpoint. The msg parameter passes user-supplied data to the application without proper sanitization, allowing attackers to inject arbitrary HTML and JavaScript that executes in the context of other users' browsers. The vulnerability exists in the endpoint handler responsible for processing chat messages, a common attack surface in web applications that accept user-generated content without server-side validation or client-side output encoding.

Know when Simple Chatbox gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

Passive

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

Low

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 13, 2026 - 05:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

CVE Published

Apr 13, 2026 - 04:15 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability has been found in code-projects Simple ChatBox up to 1.0. Affected by this vulnerability is an unknown functionality of the file /chatbox/insert.php of the component Endpoint. Such manipulation of the argument msg leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

Threat Intelligence Overview

EPSS Score

0.0%

Top 91% exploitable

Exploit

POC

Public exploit code exists

Social Media

Sightings

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.