CVE-2023-41447

MediumCVSS 6.1

Published: 28/09/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.58%

44th percentile - higher than 44% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload in the subcmd parameter of the index.php component.

Risk Assessment

An attacker can inject malicious scripts, leading to session hijacking, account takeover, or website defacement, compromising data confidentiality and integrity.

Recommendation

Immediately update the AjaxNewTicker plugin to the latest version or apply a security patch, and implement input validation and output encoding for the subcmd parameter.

Original NVD description (English source)

Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the subcmd parameter in the index.php component.