8.8
CVE-2023-41452
- EPSS 0.59%
- Veröffentlicht 27.09.2023 23:15:11
- Zuletzt bearbeitet 21.11.2024 08:21:13
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginCross Site Request Forgery vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the txt parameter in the index.php component.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Phpkobo ≫ Ajaxnewsticker Version1.0.5
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.59% | 0.435 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
http://ajaxnewsticker.com
http://phpkobo.com
https://gist.github.com/RNPG/32be1c4bae6f9378d4f382ba0c92b367