CVE-2023-41448

MediumCVSS 6.1

Published: 27/09/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.61%

45th percentile - higher than 45% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload to the ID parameter in the index.php component.

Risk Assessment

An attacker can steal user sessions, redirect users to malicious sites, or perform other harmful actions in the victim's browser, compromising data confidentiality and integrity.

Recommendation

Immediately update phpkobo AjaxNewTicker to the latest version; if unavailable, apply input filtering for the ID parameter and use Content-Security-Policy header.

Original NVD description (English source)

Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the ID parameter in the index.php component.