CVE-2023-49489

MEDIUMNuclei

KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-49489 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APP_HOST parameter at config/i18n/en/main.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 7, 2025 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryMEDIUMKodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)CVSS 6.1

Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APP_HOST parameter at config/i18n/en/main.php.

Impact

Unauthenticated attackers can inject malicious JavaScript via reflected XSS in the APP_HOST cookie parameter, potentially stealing user credentials or session cookies.

Remediation

Update KodExplorer to a version newer than 4.51 that addresses the XSS vulnerability.

WeaknessesCWE-79
AuthorsDhiyaneshDk
Template tagscvecve2023kodexplorerxssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:kodcloud:kodexplorer:4.51:*:*:*:*:*:*:*
FOFA: app="powered-by-kodexplorer"
https://github.com/kalcaddle/KodExplorer/issues/526

Source: ProjectDiscovery

References

2