CVE-2026-6004

CVE-2026-6004 is a SQL injection vulnerability in Simple IT Discussion Forum version 1.0, specifically within the /delete-category.php file where the cat_id parameter is insufficiently validated. This remote vulnerability allows attackers to manipulate the cat_id argument to execute arbitrary SQL queries against the underlying database. The exploit code has been publicly disclosed and is available for potential threat actors to leverage. The vulnerability carries a CVSS 3.1 score of 7.3 (HIGH), indicating significant risk. It requires no authentication or user interaction and can be exploited over the network with low attack complexity. The impact is broad, affecting confidentiality, integrity, and availability of the application and its data, as attackers could read, modify, or delete sensitive forum information. Regarding exploitation status, the vulnerability currently has a low EPSS score of 0.000390000, suggesting minimal real-world exploitation activity at this time. However, given that public exploit code exists and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog, organizations should treat this as a potential emerging threat rather than an active incident. Patching or disabling the affected functionality should be prioritized, particularly for internet-facing instances.