CVE-2026-4969

In the Social Networking Site 1.0 by code-projects, the file /home.php contains a stored cross-site scripting (XSS) vulnerability in the Alert Handler component. The application retrieves post content from the database and directly echoes it into the HTML without sanitization or output encoding, as seen in the code: <?php echo $row['content']; ?> [1].

An attacker with an authenticated account can craft a post containing arbitrary HTML or JavaScript. When other users view the social feed, the injected payload executes in their browsers. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) [1].

Successful exploitation allows the attacker to perform actions in the victim's session, such as stealing cookies, defacing pages, or redirecting users to malicious sites. Since the social platform promotes frequent content viewing, the attack can impact a wide audience.

A proof-of-concept exploit is publicly available. The vendor (code-projects) has not released a patch as of the publication date. Mitigation involves implementing proper output encoding on user-supplied content and applying content security policies.