CVE-2026-6159

The vulnerability is a stored cross-site scripting (XSS) in Simple ChatBox PHP version 1.0. The issue lies in the /chatbox/insert.php endpoint, which processes the 'msg' parameter from HTTP GET requests. The application stores user-supplied messages and later displays them without proper validation or output encoding, allowing injection of malicious HTML or JavaScript [1].

An attacker can send a crafted GET request with a malicious payload in the msg parameter, such as ``. The payload is stored and executed when any user views the chat messages. No authentication is required; the attack is remote and has low complexity [1].

Successful exploitation allows arbitrary JavaScript execution in other users' browsers, potentially leading to session hijacking, defacement, or data theft. The CVSS score is 6.1 (Medium) [1].

No patch has been released by the vendor (code-projects) as of the advisory. Mitigation involves implementing input validation and output encoding (e.g., htmlspecialchars) for the msg parameter [1]. Users should consider disabling the chatbox or using a web application firewall.