CVE-2023-41446

MediumCVSS 6.1

Published: 28/09/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.58%

44th percentile - higher than 44% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted title parameter in the index.php component.

Risk Assessment

An attacker can steal user sessions, redirect users to malicious sites, or infect browsers, leading to data confidentiality and integrity breaches.

Recommendation

Immediately update the AjaxNewTicker library to the latest version and apply input filtering for the title parameter in index.php.

Original NVD description (English source)

Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted script to the title parameter in the index.php component.