CVE-2026-101111
— UNSCOREDPublished 2026-09-28 · Updated 2026-09-29
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 - The public book-detail page template, site/views/view_book/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind (echo $_REQUEST["title"];). A value containing a double quote closes the attribute early and allows arbitrary HTML/JavaScript to follow.
Weaknesses
CWE-79
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2025-13533PoC
- MEDIUMCVE-2025-14814
- LOWCVE-2025-15677
- MEDIUMCVE-2025-15696
- LOWCVE-2025-15698
- MEDIUMCVE-2025-36147
- HIGHCVE-2025-61682PoC
- MEDIUMCVE-2025-71419PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.