SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-77989

MEDIUM · CVSS 5.3 EPSS 0.26%

Source: NVD + CISA KEV + EPSS · Published 2026-08-27 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The Joomla Events Manager extension prior to version 5.0.1 is vulnerable to reflected cross-site scripting (XSS) through the PDF export link, where user input is improperly handled in the URL. This flaw allows attackers to inject malicious scripts, potentially compromising user sessions or redirecting users to harmful sites. Joomla site administrators using this extension should prioritize patching to mitigate the risk of exploitation.

CVE
CVE-2026-77989
Severity
MEDIUM
CVSS
5.3
EPSS
0.26%

Original NVD Description

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton() echoes it unescaped, leading to an reflected XSS vector.