EUVD-2026-88439

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library Free 6.4.6 - The public book-detail page template, site/views/viewbook/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind echo...

CVE-2026-101111

The Joomla Extension - ordasoft.com - Book Library (Free) version

EUVD-2026-88436

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library Free quote instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two...

CVE-2026-101110

The Book Library (Free) Joomla Extension by ordasoft.com (versions