https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T18:44:26.331152+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-101109 fkie_cve-2026-101109 2026-09-29T18:44:26.353130+00:00

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of any kind. A double-quote character in the parameter closes the attribute, allowing arbitrary markup, including a <script> tag, to be injected into the page.

 https://vulnerability.circl.lu/vuln/ghsa-hmp2-w6r9-h3f2 GHSA-hmp2-w6r9-h3f2 2026-09-29T18:44:26.353226+00:00

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of any kind. A double-quote character in the parameter closes the attribute, allowing arbitrary markup, including a <script> tag, to be injected into the page.