Is there a public PoC exploit available for CVE-2026-7090?

Yes, a public proof-of-concept exploit is available for CVE-2026-7090. Prioritise patching immediately. EPSS: 0.0%.

code-projects Chat System CVE-2026-7090

Q: What is the CVSS score of CVE-2026-7090?

CVE-2026-7090 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25774 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-27 VulDB

PHP XSS Chat System Code Projects

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

4.8 (MEDIUM) 1.9 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 27, 2026 - 06:22 NVD

LOW MEDIUM

CVSS changed

Apr 27, 2026 - 06:22 NVD

2.4 (LOW) 4.8 (MEDIUM)

Analysis Generated

Apr 27, 2026 - 06:01 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 05:45 euvd

EUVD-2026-25774

Analysis Generated

Apr 27, 2026 - 05:45 vuln.today

CVE Published

Apr 27, 2026 - 05:15 nvd

LOW 1.9

DescriptionCVE.org

A vulnerability was detected in code-projects Chat System 1.0. This affects an unknown function of the file /admin/send_message.php of the component Chat Interface. The manipulation of the argument msg results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.

AnalysisAI

Stored cross-site scripting (XSS) in code-projects Chat System 1.0 allows high-privilege remote attackers to inject malicious scripts via the msg parameter in /admin/send_message.php, affecting the Chat Interface component. The vulnerability requires admin-level authentication and user interaction (viewing the crafted message), but publicly available exploit code exists and the issue is actively being leveraged. With a CVSS score of 2.4, the impact is limited to integrity violations with no confidentiality or availability loss, but the presence of public POC and active exploitation elevates practical risk despite low severity metrics.

Technical ContextAI

The vulnerability resides in the Chat Interface component of code-projects Chat System, specifically in the /admin/send_message.php file, which processes the msg parameter without proper input validation or output encoding. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) instance where user-controlled input flows directly into the application's response or storage without sanitization. The PHP application fails to escape HTML special characters or apply content security policies before rendering the msg parameter in the admin interface, allowing attackers to embed JavaScript code that executes in the context of other administrators' sessions. The CPE indicates the vulnerability affects all versions of code-projects Chat System (version wildcard), suggesting the flaw may be endemic to the product line.

RemediationAI

Apply input validation and output encoding to the msg parameter in /admin/send_message.php. At minimum, use PHP's htmlspecialchars() function on all output that renders user input: htmlspecialchars($msg, ENT_QUOTES, 'UTF-8'). Additionally, implement Content Security Policy (CSP) headers to block inline script execution: Content-Security-Policy: default-src 'self'; script-src 'self';. If a vendor patch is available from code-projects.org, upgrade the Chat System immediately; however, no specific patched version is identified in available data. As a temporary compensating control, restrict /admin/send_message.php access to a whitelist of trusted IP addresses and disable the message feature if it is not actively required. Validate and sanitize all inputs server-side, not relying on client-side filtering. Instruct administrators to avoid viewing messages from untrusted sources or to use a separate administrative account for sensitive operations until a patch is deployed.