https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 13:19:15 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-101111 <p>Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) &lt; 6.4.6 - The public book-detail page template, site/views/view_book/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind (echo $_REQUEST[&#34;title&#34;];). A value containing a double quote closes the attribute early and allows arbitrary HTML/JavaScript to follow.</p> <p>Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) &lt; 6.4.6 - The public book-detail page template, site/views/view_book/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind (echo $_REQUEST[&#34;title&#34;];). A value containing a double quote closes the attribute early and allows arbitrary HTML/JavaScript to follow.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-101111 https://vulnerability.circl.lu/vuln/ghsa-6cm5-gmw8-jj23 <p>Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) &lt; 6.4.6 - The public book-detail page template, site/views/view_book/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind (echo $_REQUEST[&#34;title&#34;];). A value containing a double quote closes the attribute early and allows arbitrary HTML/JavaScript to follow.</p> <p>Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) &lt; 6.4.6 - The public book-detail page template, site/views/view_book/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind (echo $_REQUEST[&#34;title&#34;];). A value containing a double quote closes the attribute early and allows arbitrary HTML/JavaScript to follow.</p> https://vulnerability.circl.lu/vuln/ghsa-6cm5-gmw8-jj23