PT-2026-34455 · 94Cb+1 · Carbon Forum

Chokri Hammedi · CVE-2024-58344 · Published 2026-04-22 · Updated 2026-04-22

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Carbon Forum version 5.9.0

Description An issue exists where authenticated administrators can inject malicious JavaScript code through the Forum Name field in dashboard settings. This persistent cross-site scripting (XSS)—a flaw where malicious scripts are permanently stored on the target server—allows attackers with admin privileges to store payloads that execute in the browsers of all users visiting the forum, potentially leading to session hijacking and data theft.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-58344

Affected Products

Carbon Forum

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58344.json · Exploit
• 🔥 https://exploit-db.com/exploits/52043 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-58344 · Security Note
• https://osv.dev/vulnerability/CVE-2024-58344 · Vendor Advisory
• https://github.com/lincanbin/Carbon-Forum · Note
• https://vulncheck.com/advisories/carbon-forum-persistent-xss-via-forum-name-field · Note
• https://94cb.com · Note