CVE-2026-101109
Ordasoft Vehicle Manager: cross-site scripting
- Risk score
- 40/100
- CVSS
- 6.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of any kind. A double-quote character in the parameter closes the attri…
- Affected
- Ordasoft Vehicle Manager
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Ordasoft Vehicle Manager: Amber, patch this week. Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parameters at three separate anonymous-reachable frontend entry points (category listing, search, and the all-vehicles listing) through a sanitizing…
The flaws
- CVE-2026-101109: Cross-site scripting (CVSS 6.1 · EPSS 0%)
- CVE-2026-101108: SQL injection (CVSS 9.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Ordasoft Vehicle Manager
Where it stands
- No known exploitation
Connects to
- Same weakness: Cross-site scripting (CWE-79). 399 other warnings in 30 days
Why it is Yellow
- CVSS 6.1 medium
References
Original description
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of any kind. A double-quote character in the parameter closes the attribute, allowing arbitrary markup, including a <script> tag, to be injected into the page.
Last activity 28 Sep 2026. Patch Forecast updates every hour.