CVE-2026-101111CWE-79cross-site-scripting

CVE-2026-101111

Medium · published September 28, 2026

CVSS v3.1

6.1

EPSS

Percentile

3.7

In the wild

Unconfirmed

What it is

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 - The public book-detail page template, site/views/view_book/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind (echo $_REQUEST["title"];). A value containing a double quote closes the attribute early and allows arbitrary HTML/JavaScript to follow.

The record

Technical detail

CVSS v3.1: 6.1 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: 5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS: 0.00149 · 3.7th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-09-28T23:16Z

Affected products (1)

Product	Versions	Fixed in
ordasoft/book_library	≥ 1.0.0, < 6.4.6	6.4.6

References (1)

https://www.ordasoft.com/ · [email protected]

EPSS history

Timeline

30 SEP 03:24Z
EPSS moved — → 0%
epss
28 SEP 18:48Z
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6
cvelistv5