VulnerabilityPublished 11 Sep 2023Updated 30 May 2025

CVE-2023-41103: Interact 7.9.79.5 allows stored Cross-site Scripting (XSS) attacks

Source CVE Database V5

Not known to be exploited.

Data as of 26 Oct 2026, 17:16 UTC

Severity

High

Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA

EPSS: 0.4% chance of exploitation in 30 days – higher than 38% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 11 Sep 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
n/a n/a	Affected =7.9.79.5	Fixed in–

AI-suggested

Organizations should immediately conduct a thorough audit of all input fields and stored content within Interact 7.9.79.5 to identify where malicious scripts could be injected. Until an official patch is released, implement strict input validation and output encoding on all user-supplied data, especially in areas known to be vulnerable. Employ Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts. Regularly scan the application and stored data for suspicious scripts using automated tools. Educate users about the risks of clicking on unexpected links or executing scripts. If possible, isolate the affected application from sensitive systems to limit lateral movement. Monitor logs for unusual activity indicative of exploitation attempts. Engage with the vendor or community to obtain updates or patches promptly. Finally, prepare an incident response plan tailored to XSS attacks to minimize damage if exploitation occurs.

Description

Interact 7.9.79.5 allows stored Cross-site Scripting (XSS) attacks in several locations, allowing an attacker to store a JavaScript payload.

Impact

For European organizations using Interact 7.9.79.5, this vulnerability poses a significant risk to confidentiality, integrity, and availability of web-based services. Attackers exploiting stored XSS can steal session cookies, enabling unauthorized access to user accounts and potentially sensitive corporate data. They can also perform actions on behalf of users, leading to data manipulation or privilege escalation. In environments where Interact is integrated with other enterprise systems, the impact could cascade, affecting broader IT infrastructure. Additionally, the presence of malicious scripts can damage organizational reputation and violate data protection regulations such as GDPR if personal data is compromised. The lack of known exploits may reduce immediate risk, but the vulnerability’s nature means that once exploited, it can be difficult to detect and remediate. European organizations with public-facing or internally accessible Interact portals should consider this a high-risk issue due to the potential for widespread user impact and regulatory consequences.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Jul 2025, 15:59 UTC

Technical details

References

Community reviews

Related threats