{"id":"CVE-2026-101111","title":"Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 - The public book-detail page template, site/views/view_book/tmpl/default.php, echoes the raw title request parameter directly into a double-…","summary":"Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 - The public book-detail page template, site/views/view_book/tmpl/default.php, echoes the raw title request parameter directly into a double-…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"ordasoft","product":"book_library","affected":["book_library >= 1.0.0, < 6.4.6"],"patched":["book_library 6.4.6"],"published":"2026-09-28","updated":"2026-10-01","sourceUpdated":"2026-10-01T16:01:59.130","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101111","references":[{"url":"https://www.ordasoft.com/","label":"security@joomla.org"}],"tags":["nvd","cve.org"],"epss":0.00149,"epssPercentile":0.04033,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-30T15:21:29.059944Z"},"scores":{"nvd":6.1,"cna":5.3},"ingestedAt":"2026-09-28T19:19:07.731Z","slug":"CVE-2026-101111","body":"## Overview\n\nJoomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 - The public book-detail page template, site/views/view_book/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind (echo $_REQUEST[\"title\"];). A value containing a double quote closes the attribute early and allows arbitrary HTML/JavaScript to follow.\n\n## Affected\n\n- `book_library >= 1.0.0, < 6.4.6`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `book_library 6.4.6`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":214559,"id":"CVE-2026-101111","ts":1790881061546,"field":"cvss","old":"5.3","new":"6.1"}]}