CVE-2026-7090

LowCVSS 2.4

Published: 27/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

17th percentile - higher than 17% of all known CVEs

Summary

A vulnerability was detected in code-projects Chat System 1.0. It affects an unknown function in /admin/send_message.php within the Chat Interface component. Manipulation of the msg argument results in cross site scripting, and the attack may be launched remotely.

Risk Assessment

A public exploit is already available and could be used. This could lead to malicious script execution in the user's browser.

Recommendation

Upgrade Chat System to a version containing the fix or apply mitigations. Restricting access to the administrative interface is advised.

Other vulnerabilities in Chat System

CVE-2026-7103Low
A vulnerability was found in Chat System 1.0 involving use of a weak hash (MD5) when handling the Password argument in update_user.php. The attack is remotely possible, though rated high complexity, and a public exploit has been disclosed.

Original NVD description (English source)

A vulnerability was detected in code-projects Chat System 1.0. This affects an unknown function of the file /admin/send_message.php of the component Chat Interface. The manipulation of the argument msg results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS