{"id":"CVE-2026-7090","state":"PUBLISHED","title":"code-projects Chat System send_message.php cross site scripting","description":"A vulnerability was detected in code-projects Chat System 1.0. This affects an unknown function of the file /admin/send_message.php of the component Chat Interface. The manipulation of the argument msg results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.","publishedAt":"2026-04-27T05:15:09.222Z","updatedAt":"2026-04-27T12:06:41.898Z","severity":{"score":4.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["code-projects Chat System"],"affected":[{"vendor":"code-projects","product":"Chat System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:code-projects:chat_system:*:*:*:*:*:*:*:*"],"modules":["Chat Interface"]}],"references":["https://vuldb.com/vuln/359665","https://vuldb.com/vuln/359665/cti","https://vuldb.com/submit/800383","https://gist.github.com/higordiego/4683bee16b197643744159b76d0c1ea6","https://code-projects.org/"],"weaknesses":["CWE-79","CWE-94"],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/7xxx/CVE-2026-7090.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-7090","state":"PUBLISHED","datePublished":"2026-04-27T05:15:09.222Z","dateUpdated":"2026-04-27T12:06:41.898Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-04-26T08:25:57.631Z"},"containers":{"cna":{"title":"code-projects Chat System send_message.php cross site scripting","descriptions":[{"lang":"en","value":"A vulnerability was detected in code-projects Chat System 1.0. This affects an unknown function of the file /admin/send_message.php of the component Chat Interface. The manipulation of the argument msg results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used."}],"affected":[{"vendor":"code-projects","product":"Chat System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:code-projects:chat_system:*:*:*:*:*:*:*:*"],"modules":["Chat Interface"]}],"references":[{"url":"https://vuldb.com/vuln/359665","name":"VDB-359665 | code-projects Chat System send_message.php cross site scripting","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359665/cti","name":"VDB-359665 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/800383","name":"Submit #800383 | code-projects Chat System Using PHP 1.0 Stored Cross-Site Scripting (XSS)","tags":["third-party-advisory"]},{"url":"https://gist.github.com/higordiego/4683bee16b197643744159b76d0c1ea6","tags":["exploit"]},{"url":"https://code-projects.org/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.8,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":2.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":2.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":3.3,"vectorString":"AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-04-27T05:15:09.222Z"},"timeline":[{"time":"2026-04-26T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-04-26T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-04-26T10:31:02.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"c4ttr4ck (VulDB User)","type":"reporter"}],"tags":["x_freeware"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-27T12:06:29.441194Z","id":"CVE-2026-7090","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-27T12:06:41.898Z"}}]}}}