CVE-2023-44813

Deeper analysis

CVE-2023-44813 is a reflected cross-site scripting vulnerability (CWE-79) affecting mooSocial version 3.1.8. The flaw resides in the invite friend login function, where the mode parameter fails to sanitize user-supplied input, enabling a remote attacker to supply a crafted payload that executes JavaScript in the context of another user’s session. The issue carries a CVSS 3.1 base score of 6.1 with network attack vector, low complexity, no required privileges, and required user interaction.

An unauthenticated remote attacker can exploit the vulnerability by delivering a malicious link or request containing the crafted mode parameter. Successful exploitation results in script execution that can read limited sensitive data or perform actions within the victim’s browser session, with the changed scope indicating impact beyond the vulnerable component itself.

The EPSS score for this CVE rose from a low baseline to a peak of 0.3780 on 2025-12-11 before receding to the current value of 0.2079, indicating a period of increased exploitation interest after public disclosure. Public references consist of proof-of-concept repositories demonstrating the payload but contain no vendor advisory or patch information.