CVE-2026-100753
Ordasoft Real Estate Manager: cross-site scripting
- Risk score
- 40/100
- CVSS
- 6.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment field on the same fo…
- Affected
- Ordasoft Real Estate Manager
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Ordasoft Real Estate Manager: Amber, patch this week. Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and the full property listing) from a request-controlled order_field para…
The flaws
- CVE-2026-100753: Cross-site scripting (CVSS 6.1 · EPSS 0%)
- CVE-2026-100752: SQL injection (CVSS 9.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Ordasoft Real Estate Manager
Where it stands
- No known exploitation
Connects to
- Same weakness: Cross-site scripting (CWE-79). 399 other warnings in 30 days
Why it is Yellow
- CVSS 6.1 medium
References
Original description
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment field on the same form, which at least receives partial tag-stripping. A " character in the title query parameter breaks out of the HTML attribute the value is placed in, allowing a following <script> element to execute in the browser of anyone who loads the crafted link.
Last activity 28 Sep 2026. Patch Forecast updates every hour.