CVE-2026-6161: Simple ChatBox SQLi — High Severity, Public Exploit

The National Vulnerability Database (NVD) has logged CVE-2026-6161, a high-severity SQL injection vulnerability impacting Code-Projects’ Simple ChatBox, specifically versions up to 1.0. This flaw, rated 7.3 on the CVSS scale, resides within an unspecified part of the /chatbox/insert.php file, specifically tied to the ‘Endpoint’ component.

Attackers can trigger this vulnerability by manipulating the msg argument, leading to SQL injection. What makes this particularly nasty is its remote exploitability and the fact that a public exploit has already been disclosed. This significantly lowers the bar for threat actors looking to leverage this weakness, making it a critical concern for anyone still running this particular chatbox solution. The NVD classifies this under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Different Context) and CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)), highlighting a fundamental input validation failure.