CVE-2023-41451
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'txt' parameter of the index.php component.
Risk Assessment
An attacker can inject a malicious script that executes in the victim's browser, potentially leading to session hijacking, redirection to malicious sites, or theft of sensitive data.
Recommendation
Immediately update phpkobo AjaxNewTicker to the latest available version and apply input filtering and validation for the 'txt' parameter.
Original NVD description (English source)
Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the txt parameter in the index.php component.