The vulnerability CVE-2026-6161 affects code-projects Simple ChatBox up to version 1.0. It is located in the /chatbox/insert.php file within the Endpoint component. An attacker can manipulate the 'msg' parameter to perform SQL injection attacks remotely. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on confidentiality, integrity, and availability. No official patch or remediation level has been published by the vendor as of the data provided.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands on the backend database through the vulnerable 'msg' parameter. This can lead to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impacts and the lack of required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as a temporary mitigation to prevent SQL injection via the 'msg' parameter. Monitoring for unusual database queries may also help detect exploitation attempts.