Vulnerability · Published Apr 22, 2026 · Assigned by VulnCheck

CVE-2024-58344Carbon Forum 5.9.0 Persistent XSS via Forum Name Field

Medium 6.4

In plain English

A medium-severity cross-site scripting in Carbon Forum from 94Cb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.2%top 90.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard settings. Attackers with admin privileges can store JavaScript payloads in the Forum Name field that execute in the browsers of all users visiting the forum, enabling session hijacking and data theft.

Affected products (as reported)

Vendor	Product	Versions
94Cb	Carbon Forum	5.9.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

ExploitDB-52043 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: Carbon Forum 5.9.0 Persistent XSS via Forum Name Field third-party-advisory