CVE-2002-1458: Leszek Krupinski L-Forum

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

Cross-site scripting vulnerability in L-Forum 2.40 and earlier, when the "Enable HTML in messages" option is on, allows remote attackers to insert arbitrary script or HTML via message fields including (1) From, (2) E-Mail, (3) Subject and (4) Body.

Affected products

Published 2003-06-09. Last modified 2026-06-16.