CVE-2026-101109
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of any kind. A double-quote character in the parameter closes the attribute, allowing arbitrary markup, including a <script> tag, to be injected into the page.
| CWE | CWE-79 |
| Vendor | ordasoft.com |
| Product | vehicle manager (free) extension for joomla |
| Published | Sep 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for ordasoft.com vehicle manager (free) extension for joomla
Be the first to know when new unknown vulnerabilities affecting ordasoft.com vehicle manager (free) extension for joomla are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
ordasoft.com / Vehicle Manager (Free) extension for Joomla
1.0.0-6.5.7
Credits
Ala Arfaoui