CVE-2026-101109 – Joomla Extension – ordasoft.com – Reflected Cross-Site Scripting in Vehicle Manager (Free)

Joomla Extension – ordasoft.com – Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 – The public vehicle-detail page (task=view) echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of any kind. A double-quote character in the parameter closes the attribute, allowing arbitrary markup, including a tag, to be injected into the page.