CVE-2023-41447
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload in the subcmd parameter of the index.php component.
Risk Assessment
An attacker can inject malicious scripts, leading to session hijacking, account takeover, or website defacement, compromising data confidentiality and integrity.
Recommendation
Immediately update the AjaxNewTicker plugin to the latest version or apply a security patch, and implement input validation and output encoding for the subcmd parameter.
Other vulnerabilities in phpkobo AjaxNewTicker
See all- CVE-2023-41453Medium
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'cmd' parameter of the index.php component.
- CVE-2023-41452High
A CSRF vulnerability in phpkobo AjaxNewTicker version 1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload in the txt parameter of the index.php component.
- CVE-2023-41451Medium
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'txt' parameter of the index.php component.
- CVE-2023-41448Medium
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload to the ID parameter in the index.php component.
- CVE-2023-41445Medium
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker version 1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the index.php component.
Original NVD description (English source)
Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the subcmd parameter in the index.php component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS