rootpwn

medium · CVSS v3 6.1 · CVSS v4 5.3

CVE-2026-100753

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public prop…

Description

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment field on the same form, which at least receives partial tag-stripping. A " character in the title query parameter breaks out of the HTML attribute the value is placed in, allowing a following

Scores

Severity
medium
CVSS v2
4.3
CVSS v3
6.1
CVSS v4
5.3
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-101141

A flaw has been found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/audio.jsp of the component Play Audio Page. Executing a manipulation of the argument viewRoleId/cfType can lead to cross site scripting. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-101858

A remote OS command injection flaw exists in RaspAP raspap-webgui versions up to 3.5.5, allowing attackers to execute arbitrary commands via the SSID field. The vulnerability is triggered by manipulating the ssid argument in WiFiManager::writeWpaSupplicant. It can be exploited without authentication, potentially compromising the underlying system.

View analysis

medium

CVE-2026-86157

Progress Telerik Fiddler Everywhere before v8.2.0 exposes privileged IPC functionality. A local low‑privileged attacker can manipulate launch parameters to replace UI or settings, potentially leaking OAuth tokens or executing local code. This vulnerability affects users running the affected version on Windows, Linux, or macOS.

View analysis

medium

CVE-2026-101279

OpenDMARC up to 1.4.2 contains an integer overflow in the pct argument of the DMARC parser, which can be triggered remotely and may corrupt memory or cause a denial of service. It affects any mail server using the vulnerable OpenDMARC library.

View analysis