CVE-2023-43325

MediumPublished

A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user's session...

Published: Sep 25, 2023
Updated: Sep 24, 2024
Assigning CNA: mitre
Evidence observed: Aug 8, 2026

Primary CVSS

6.1/ 10Medium

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS probability estimate

2.0%

Low · next 30 days

Percentile: 80.7%
Model date: Oct 15, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

MooSocial 3.1.8 - Cross-Site ScriptingTemplate
http/cves/2023/CVE-2023-43325.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: 17f5725dc10cRelated tool
Declared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)

CVE-2023-43325PoC
mooSocial v3.1.8 is vulnerable to cross-site scripting on user login function.

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.