CVE-2026-6159

CVE-2026-6159 is a reflected cross-site scripting (XSS) vulnerability affecting Simple ChatBox versions up to 1.0, specifically in the /chatbox/insert.php endpoint where the "msg" parameter fails to properly sanitize user input. This vulnerability allows attackers to inject malicious scripts that execute in the context of a victim's browser session. The vulnerability carries a CVSS score of 4.3 (Medium) and requires only network access with no special privileges or system complexity to exploit, though it does require user interaction to trigger. The attack vector is remote with low complexity, and while the integrity of the application data could be compromised through script injection, there is no direct impact to confidentiality or system availability. Exploitation of this vulnerability is currently not widespread. The exploit has been publicly disclosed, creating potential for opportunistic attacks, but the low EPSS score of 0.00035 and its status as inactive on vulnerability hot lists indicate minimal real-world exploitation activity to date. Organizations running affected versions should implement updates when available, but this does not appear to be an actively targeted vulnerability in the current threat landscape.