EUVD-2026-88437
GHSA-hmp2-w6r9-h3f2
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a genuine-but-low-severity reflected XSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) shows a network-reachable, low-complexity, unauthenticated flaw whose exploitation hinges on user interaction (UI:P) - a victim must click an attacker-crafted link. Impacts are Low across VC/VI/VA, giving a modest 5.3. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so no automated or confirmed exploitation signal exists - the risk is theoretical/opportunistic rather than actively-exploited. The single reference (ordasoft.com) is only the vendor homepage with no dedicated advisory, so the fix version (<6.5.8) is asserted by the Joomla reporter rather than independently corroborated. Net: real vulnerability, easily fixed by upgrading, but low real-world priority given the niche product, required user interaction, and only Low CIA impact. No high-CVSS-vs-low-risk conflict here - score and reality both point to low priority. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Reflected cross-site scripting in the Vehicle Manager (Free) extension for Joomla before 6.5.8 allows an unauthenticated attacker to inject arbitrary markup and script into a page by crafting a malicious 'title' parameter on the public vehicle-detail page (task=view). The parameter is echoed straight into a double-quoted HTML attribute with no output encoding, so a double-quote character breaks out of the attribute and permits a <script> tag to be injected; exploitation requires the victim to follow a crafted link (CVSS 4.0 vector shows PR:N with UI:P, yielding a base score of 5.3). No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, so this is a genuine but low-severity reflected XSS whose practical impact is limited to script execution in the context of a victim user's session.
RemediationAI
Apply the vendor-released patch by upgrading the Vehicle Manager (Free) extension for Joomla to version 6.5.8 or later, obtained from the vendor at https://www.ordasoft.com/; because this is a third-party extension, the fix is not delivered through Joomla core updates and must be downloaded and installed manually through the Joomla extension manager. If immediate upgrade is not possible, reduce exposure by disabling or unpublishing the Vehicle Manager component and its vehicle-detail menu items so the vulnerable task=view code path is unreachable, accepting the loss of the public vehicle listing functionality as the trade-off. As a supplementary control, deploy a web application firewall or reverse-proxy rule that blocks requests whose 'title' parameter contains double-quote or angle-bracket characters on the affected task=view route, but treat this as a stopgap only since crafted encodings can bypass naive filters. Additional hardening that limits the ceiling of any XSS on the site includes setting HttpOnly and SameSite flags on Joomla session cookies so injected script cannot trivially read session tokens, and enforcing a restrictive Content-Security-Policy that disallows inline script; both reduce impact but do not remove the injection point and may break legitimate third-party extensions, so they should be tested before rollout. After upgrading, re-scan the site to confirm the extension version and verify that the title parameter is now contextually escaped in rendered output.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-79 improper neutralization of user-supplied input during web page generation, manifesting specifically as reflected XSS in a Joomla component. The affected code path is the public vehicle-detail view (task=view) of the Vehicle Manager (Free) extension published by ordasoft.com, which takes the 'title' request parameter and interpolates it directly into a double-quoted HTML attribute without any contextual output encoding or escaping (no htmlspecialchars, no attribute-context sanitization). Because the injection point is inside a quoted attribute, an attacker only needs to supply a double-quote character to terminate the attribute value and then append arbitrary markup, including a <script> element, an event handler attribute, or a javascript: URI. The CPE string cpe:2.3:a:ordasoft.com:vehicle_manager_(free)_extension_for_joomla:*:*:*:*:*:*:*:* identifies this as a third-party Joomla extension rather than Joomla core, meaning the vulnerable code is supplied and maintained by the extension vendor and is not covered by Joomla core security releases. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms the attack is network-delivered, low complexity, needs no privileges, and depends on the victim performing a user action such as clicking a crafted URL; the low confidentiality, integrity and availability impacts (VC:L/VI:L/VA:L) with no subsequent system impact (SC:N/SI:N/SA:N) are consistent with script execution bounded by the victim's browser and the site's cookie/session protections.
Know when Vehicle Manager Free Extension For Joomla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Primary rating from Vendor (Joomla) · only source for this CVE.
CVSS VectorVendor: Joomla
DescriptionCVE.org
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of any kind. A double-quote character in the parameter closes the attribute, allowing arbitrary markup, including a <script> tag, to be injected into the page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB