CVE Catalog
CVE-2026-75955
MediumCVSS 5.1Summary
The Joomla extension - cmsjunkie.com - J-BusinessDirectory before version 6.2.3 contains a reflected XSS / XML injection vulnerability. The companyName parameter from the request is written unescaped into an XML attribute, potentially allowing execution of malicious scripts in the victim's browser.
Risk Assessment
An attacker can exploit this to execute malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or other phishing attacks.
Recommendation
Upgrade the J-BusinessDirectory extension to version 6.2.3 or later, which includes a fix.
Original NVD description (English source)
Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3 - companyName from the request was written unescaped into an XML attribute.