code-projects Chat System CVE-2026-7090

Exploitation requires (1) valid admin-level authentication to access /admin/send_message.php, (2) the ability to submit a crafted msg parameter to the send_message.php endpoint, and (3) a second authenticated user (typically another admin) to view the malicious message within the Chat Interface for the XSS payload to execute. Default configurations of code-projects Chat System 1.0 are vulnerable if the application does not implement additional input validation or output encoding beyond what is described. No special feature configuration is mentioned as required; the vulnerability is present in the standard Chat Interface component. Exploitation is limited to admin-to-admin attacks and cannot be leveraged by unauthenticated remote users or low-privilege accounts.

This vulnerability presents a moderately low severity risk according to CVSS (2.4), but real-world exploitation potential is elevated by several factors. The CVSS vector AV:N/AC:L indicates remote network access with low attack complexity, but the PR:H (high privilege required) restriction significantly limits the attack surface-only admin-level users can craft the malicious message, and a second admin or authorized user must view it for the XSS to execute (UI:R, user interaction required). The EPSS score is not provided, but the presence of public POC code and active exploitation (E:P in the vector) demonstrates that the theoretical vulnerability is moving toward practical abuse. The scope is unchanged (S:U), meaning the attacker gains no privilege escalation beyond the initial admin account; integrity impact is low (I:L), limited to unauthorized modification of what other admins see. The critical limiting factor is PR:H-this is not a widespread threat to unauthenticated users or low-privilege accounts, but a targeted risk within organizations where multiple admins use the same Chat System instance. Organizations relying on admin accounts as trusted parties should assess whether lateral persistence or social engineering via admin messages justifies remediation effort. The combination of low CVSS but public POC suggests this is a real but contained vulnerability: dangerous if you run this specific product, irrelevant if you do not.

An attacker with admin credentials (obtained via credential theft, insider threat, or compromised account) crafts a message containing JavaScript payload in the msg parameter (e.g., msg=<img src=x onerror='fetch(/exfil?cookie='+document.cookie)'>). When a second administrator views the message in the Chat Interface, the script executes in their browser session, potentially exfiltrating session cookies or performing unauthorized actions on behalf of that admin. The public POC available on GitHub demonstrates this exact workflow, lowering the barrier for non-expert attackers.