CVE-2026-101109: Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of any kind. A double-quote character in the parameter closes the attribute, allowing arbitrary markup, including a <script> tag, to be injected into the page.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Sites using Ordasoft Vehicle Manager (Free) versions earlier than 6.5.8 are affected when the public vehicle-detail page is accessible.
What does an attacker need to exploit this issue?
An attacker needs to supply a malicious title request parameter in a request to the vehicle-detail page using task=view. A double quote can terminate the existing HTML attribute and permit injected markup, including script tags.