CVE-2026-100753
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
61/100
Published: 2026-09-28
Modified: 2026-10-27
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Passive
S:
X
AT:
None
VC:
Low
VI:
Low
VA:
Low
Description
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment field on the same form, which at least receives partial tag-stripping. A " character in the title query parameter breaks out of the HTML attribute the value is placed in, allowing a following <script> element to execute in the browser of anyone who loads the crafted link.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| ordasoft | real_estate_manager | < 6.7.9 |
References & Advisories (1)
Product