medium5.3
CVE-2026-77989
Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - buildCurrentPdfLink copies the current req…
Impact
Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton() echoes it unescaped, leading to an reflected XSS vector.
Affected products
| Product | Affected versions |
|---|---|
| Joomla Events Manager | before 5.0.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.