CVE-2026-101141

A cross-site scripting (XSS) vulnerability exists in Eleveo Call Recording Software 9.7.0 within the Play Audio Page component. The flaw is located in an unknown function of the file /callrec/audio.jsp , where an attacker can remotely manipulate the viewRoleId/cfType argument to execute the attac...

CVE-2026-101111 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library Free 6.4.6 - The public book-detail page template, site/views/viewbook/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind echo...

EUVD-2026-88439

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library Free 6.4.6 - The public book-detail page template, site/views/viewbook/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind echo...

CVE-2026-101111

The Joomla Extension - ordasoft.com - Book Library (Free) version

CVE-2026-101111 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library Free 6.4.6 - The public book-detail page template, site/views/viewbook/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind echo...

CVE-2026-101109 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager Free tag, to be injected into the page...

EUVD-2026-88437

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager Free tag, to be injected into the page...

CVE-2026-101109

The Joomla Extension - ordasoft.com - Vehicle Manager (Free) is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 6.5.8 . The root cause is that the public vehicle-detail page (triggered by task=view) echoes the title request parameter directly into a double-quoted HTML attr...

EUVD-2026-88436

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library Free quote instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two...

CVE-2026-101110

The Book Library (Free) Joomla Extension by ordasoft.com (versions

CVE-2026-101110 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library Free quote instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two...

[SECURITY] [DSA 6525-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6525-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 28, 2026 https://www.debian.org/security/faq -...

EUVD-2026-88435

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...

CVE-2026-100753

The Joomla Extension - ordasoft.com - Real Estate Manager (Free) is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 6.7.9 . The issue exists on the public property-detail page's "leave a review" form, where the title field repopulates from the request without any escaping ...

CVE-2026-100753 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...

CVE-2026-100752 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager Free 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries category browsing, search results, and the full property listing from a request-controlled...

CVE-2026-100752

The Joomla Extension - ordasoft.com - Real Estate Manager (Free) version

CVE-2026-100752 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager Free 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries category browsing, search results, and the full property listing from a request-controlled...

EUVD-2026-88434

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager Free 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries category browsing, search results, and the full property listing from a request-controlled...

CVE-2026-101108 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager Free 6.5.8 - site/vehiclemanager.php reads the orderfield and orderdirection sort parameters at three separate anonymous-reachable frontend entry points category listing, search, and the all-vehicles listing throug...