PT-2025-51288 · Jorani · Jorani

Nu11Secur1Ty · Published 2025-12-15 · Updated 2025-12-21 · CVE-2023-53870

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jorani version 1.0.3

Description The software contains a reflected cross-site scripting issue in the language parameter. An attacker can inject malicious scripts by crafting XSS payloads within this parameter, potentially enabling the execution of arbitrary JavaScript and the theft of user session information.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize the language parameter to prevent the injection of malicious scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-53870

Affected Products

Jorani

References · 6

• 🔥 https://exploit-db.com/exploits/51715 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53870 · Security Note
• https://jorani.org · Note
• https://vulncheck.com/advisories/jorani-cross-site-scripting-vulnerability-via-language-parameter · Note
• https://twitter.com/CVEnew/status/2002857378933583885 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2000766264784867740 · Twitter Post