Vehicle Manager

vehicle_manager

Vendor: Ordasoft • 2 CVEs

CVEs (2)

CVE

VENDORS

PRODUCTS

UPDATED

PUBLISHED

CVSS

CVE-2026-101109

1Ordasoft

1Vehicle Manager

Oct 27, 2026

Sep 28, 2026

5.3 MEDIUM· v4

6.1 MEDIUM· v3

N/A· v2

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of any kind. A double-quote character in the parameter closes the attribute, allowing arbitrary markup, including a <script> tag, to be injected into the page.Show less

CVE-2026-101108

1Ordasoft

1Vehicle Manager

Oct 27, 2026

Sep 28, 2026

9.3 CRITICAL· v4

9.8 CRITICAL· v3

N/A· v2

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parameters at three separate anonymous-reachable frontend entry points (category listing, search, and the all-vehicles listing) through a sanitizing function that applies real escaping, but the value is then placed into an unquoted ORDER BY clause, where escaping has no protective effect.Show less