Medium severity6.4NVD Advisory· Published Apr 22, 2026· Updated Apr 22, 2026

CVE-2024-58344

Description

Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard settings. Attackers with admin privileges can store JavaScript payloads in the Forum Name field that execute in the browsers of all users visiting the forum, enabling session hijacking and data theft.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Lincanbin/Carbon Forumreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: =5.9.0

Patches

Vulnerability mechanics

References

www.94cb.comnvd
www.exploit-db.com/exploits/52043nvd
www.vulncheck.com/advisories/carbon-forum-persistent-xss-via-forum-name-fieldnvd

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000