CVE-2024-58344
Carbon Forum 5.9.0 Persistent XSS via Forum Name Field
- State
- Published
- Severity
- 5.1 Medium
- Published
- Apr 22, 2026
- Updated
- May 24, 2026
- Reserved
- Apr 21, 2026
Description
Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard settings. Attackers with admin privileges can store JavaScript payloads in the Forum Name field that execute in the browsers of all users visiting the forum, enabling session hijacking and data theft.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Carbon Forum94Cb |
|
References
- ExploitDB-52043exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: Carbon Forum 5.9.0 Persistent XSS via Forum Name Fieldthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.