CVE-2023-41449

CriticalCVSS 9.8

Published: 27/09/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.15%

63th percentile - higher than 63% of all known CVEs

Summary

The AjaxNewsTicker plugin version 1.0.5 contains a vulnerability that allows a remote attacker to execute arbitrary code via a crafted payload in the 'reque' parameter. The issue stems from insufficient input validation.

Risk Assessment

An attacker could take control of the server, steal data, or install malware, compromising the confidentiality, integrity, and availability of the system.

Recommendation

Immediately update the AjaxNewsTicker plugin to the latest available version or apply a security patch. If an update is not possible, temporarily disable the plugin.

Original NVD description (English source)

An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter.