CVE-2024-58344

MEDIUM

6.4

Description

Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard settings. Attackers with admin privileges can store JavaScript payloads in the Forum Name field that execute in the browsers of all users visiting the forum, enabling session hijacking and data theft.

CVE Details

CVSS v3.1 Score6.4

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published4/22/2026

Last Modified4/22/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-79

References

https://github.com/lincanbin/Carbon-Forum(disclosure@vulncheck.com)

https://www.94cb.com/(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/52043(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/carbon-forum-persistent-xss-via-forum-name-field(disclosure@vulncheck.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.