Threats tagged 'ghsa-6cm5-gmw8-jj23'

A reflected cross-site scripting (XSS) vulnerability exists in the ordasoft.com Book Library (Free) extension for Joomla versions 1.0.0 through 6.4.6. The vulnerability occurs because the public book-detail page template directly echoes the raw 'title' request parameter into a double-quoted HTML attribute without any escaping. This allows an attacker to inject arbitrary HTML or JavaScript by including a double quote in the 'title' parameter, potentially leading to script execution in the context of the victim's browser.