CVE-2023-41538

Deeper analysis

phpjabbers PHP Forum Script 3.0 contains a reflected cross-site scripting vulnerability (CWE-79) that is triggered through the keyword parameter. The flaw received a CVSS 3.1 score of 6.1 with network attack vector, low complexity, no required privileges, and required user interaction, resulting in limited confidentiality and integrity impact under a changed scope.

An unauthenticated remote attacker can supply a crafted URL containing malicious JavaScript in the keyword parameter. When a victim follows the link, the script executes in the victim's browser context, enabling actions such as session token theft, page defacement, or redirection to attacker-controlled sites.

Public references consist of proof-of-concept repositories that demonstrate the injection but contain no vendor advisory, patch information, or official mitigation guidance.

The EPSS score rose from a low baseline to a recorded peak of 0.1661 before settling at 0.1282, indicating measurable post-disclosure exploitation interest that warrants monitoring.