The vulnerability CVE-2026-6004 affects code-projects Simple IT Discussion Forum 1.0. It arises from improper sanitization of the cat_id parameter in the /delete-category.php script, enabling remote attackers to inject SQL commands. This can lead to unauthorized database queries or modifications. The vulnerability is remotely exploitable without authentication and has a medium severity rating with a CVSS 4.0 score of 6.9. No vendor patch or official fix has been disclosed yet.

Successful exploitation of this SQL injection vulnerability could allow attackers to manipulate database queries, potentially leading to unauthorized data access or modification. The impact is rated medium based on the CVSS score and the lack of required privileges or user interaction for exploitation. However, the exact extent of impact depends on the database and application context, which is not detailed in the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or web application firewall rules to block malicious payloads targeting the cat_id parameter in /delete-category.php. Monitoring for unusual database activity related to this endpoint is also advisable.