CVE-2026-101109: Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-28 · updated 2026-10-27
Weakness: CWE-79

Description

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of any kind. A double-quote character in the parameter closes the attribute, allowing arbitrary markup, including a <script> tag, to be injected into the page.

Affected products

Ordasoft Vehicle Manager: before 6.5.8 — fixed in 6.5.8
ordasoft.com Vehicle Manager (Free) extension for Joomla: 1.0.0-6.5.7

How to fix

Upgrade to a fixed version: Ordasoft Vehicle Manager 6.5.8. Check the vendor advisory for mitigations.

References

https://www.ordasoft.com/

Get alerted when CVE-2026-101109 or the next vulnerability affects your stack