CVE-2002-1459: Leszek Krupinski L-Forum

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

Cross-site scripting vulnerability in L-Forum 2.40 and earlier, when the "Enable HTML in messages" option is off, allows remote attackers to insert arbitrary script or HTML via message fields including (1) From, (2) E-Mail, and (3) Subject.

Affected products

Published 2003-06-09. Last modified 2026-06-16.