Reflected Cross-Site Scripting in Joomla Extension Vehicle Manager by Ordasoft

CVE-2026-101109

What is CVE-2026-101109?

A reflected cross-site scripting vulnerability exists in the Vehicle Manager extension for Joomla prior to version 6.5.8. This flaw arises from the mishandling of the 'title' request parameter on the public vehicle-detail page, where it is echoed directly into a double-quoted HTML attribute without any form of output encoding. An attacker can exploit this issue by crafting a malicious URL that includes a specially crafted title, leading to the injection of arbitrary HTML or JavaScript content into the page. Users accessing this page could unknowingly execute malicious scripts, potentially compromising their data and security.

References