CVE-2026-101109 — Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8

CVE-2026-101109

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 PUBLISHED

Description (CNA)

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of any kind. A double-quote character in the parameter closes the attribute, allowing arbitrary markup, including a <script> tag, to be injected into the page.

Affected (CNA)

Vendor / product	Versions
ordasoft.com / Vehicle Manager (Free) extension for Joomla	affected 1.0.0-6.5.7

CWE

CWE-79

References

https://www.ordasoft.com/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.