CVE-2026-5828

CVE-2026-5828 is a SQL injection vulnerability identified in Simple IT Discussion Forum version 1.0, specifically within the /functions/addcomment.php file where the postid parameter fails to properly sanitize user input. This remote code execution risk affects any organization running the vulnerable version of this forum software without patches or mitigations in place. The vulnerability carries a CVSS score of 7.3 (HIGH severity) with a network-based attack vector requiring no authentication or user interaction, making it relatively easy to exploit. The flaw enables attackers to achieve limited confidentiality, integrity, and availability impact through SQL injection attacks that could result in unauthorized data access, modification, or service disruption. Exploit code has been publicly released for this vulnerability, which increases operational risk. However, the EPSS score of 0.000390 indicates minimal real-world exploitation prevalence to date, and the vulnerability is not currently tracked on the CISA Known Exploited Vulnerabilities catalog. Organizations using Simple IT Discussion Forum 1.0 should prioritize patching or implementing compensating controls, though the moderate community attention suggests this may not be an immediate mass-exploitation threat.