J-BusinessDirectory CVE-2026-75955

Exploitation requires the target Joomla site to have the J-BusinessDirectory extension installed and active in a version prior to 6.2.3, with the affected endpoint reachable over the network. No attacker authentication is required (PR:N per CVSS 4.0 vector). A victim user must actively interact with a crafted URL (UI:A - active user interaction required); without this, the reflected payload is never triggered. Sites not running this specific extension are entirely unaffected regardless of Joomla core version. The attack does not persist between requests, so each exploitation event is independent and requires a separate victim interaction.

The CVSS 4.0 score of 5.1 (Medium) accurately captures the constrained impact profile: AV:N confirms network reachability, AC:L and PR:N indicate no special complexity or attacker authentication required, but UI:A mandates active victim interaction - an attacker must socially engineer a specific user into clicking a crafted URL. Impact metrics VC:N/VA:N and SC:N/SI:N/SA:N confirm no confidentiality or availability consequence, with only low integrity impact (VI:L) within the vulnerable system. No EPSS score was supplied; KEV status is absent; no public exploit code is known. The reflected (non-persistent) nature means each exploitation event demands a fresh victim interaction, substantially limiting blast radius compared to stored XSS. Real-world risk is moderate for sites with exposed business directory search functionality and a user base susceptible to phishing, but is negligible for sites that do not have this extension installed.

An attacker identifies a Joomla site running an unpatched version of J-BusinessDirectory and crafts a URL in which the companyName parameter contains a JavaScript payload. The URL is distributed to targeted users - site administrators, registered members, or anonymous visitors - via phishing email or social media. When a victim clicks the link, the Joomla site reflects the unencoded payload within an XML attribute in the response, causing the script to execute in the victim's browser and potentially exfiltrating session cookies or performing authenticated actions on the victim's behalf.