Threats tagged 'ghsa-hmp2-w6r9-h3f2'

A reflected cross-site scripting (XSS) vulnerability exists in the Vehicle Manager (Free) extension for Joomla versions 1.0.0 through 6.5.7. The vulnerability occurs because the public vehicle-detail page (task=view) directly inserts the title request parameter into a double-quoted HTML attribute without proper output encoding. This allows an attacker to inject arbitrary HTML or script code by including a double-quote character in the parameter, potentially leading to script execution in the victim's browser.