Vulnerability Details CVE-2026-101109
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of any kind. A double-quote character in the parameter closes the attribute, allowing arbitrary markup, including a <script> tag, to be injected into the page.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 17.9%
CVSS Severity
CVSS v3 Score 6.1
References
Products affected by CVE-2026-101109
-
cpe:2.3:a:ordasoft:vehicle_manager:*