CVE-2025-2714

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /extensions/realestate/index.php/agents/agent-register/addagent. The manipulation of the argument plan_id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
JoomlaUX	JUX Real Estate	3.4.0

References

https://vuldb.com/?ctiid.300734Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.300734Third Party Advisory, VDB Entry
https://vuldb.com/?submit.517638Third Party Advisory, VDB Entry
https://vuldb.com/?submit.517638Third Party Advisory, VDB Entry

Timeline

Published: Mar 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-271409.8WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the CVE-2025-271416.5Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.4 CVE-2025-271428.8LocalSend is a free, open-source app that allows users to securely share files and messages with nearby devices over their local network wit CVE-2025-271436.1Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open CVE-2025-271446.6Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web En CVE-2025-271456.1copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is con CVE-2025-271464.3matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability whic CVE-2025-271478.2The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deploym CVE-2025-271488.8Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system tem CVE-2025-271492.7Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization CVE-2025-27153.5A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file CVE-2025-271506.5Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance