CVE-2023-41453

MediumCVSS 6.1

Published: 27/09/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.58%

44th percentile - higher than 44% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'cmd' parameter of the index.php component.

Risk Assessment

An attacker can steal user sessions, redirect victims to malicious sites, or perform other unauthorized actions in the victim's browser context, leading to data confidentiality and integrity breaches.

Recommendation

Immediately update phpkobo AjaxNewTicker to the latest available version; if not available, apply input filtering and output encoding for the 'cmd' parameter and consider using a Web Application Firewall (WAF).

Original NVD description (English source)

Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the cmd parameter in the index.php component.