CVE-2026-63264

MediumCVSS 5.3/10Last modified Oct 24, 2026

Description

Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller.

Metrics

CVSS 4.0 5.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 22, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-632658.0Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Pr CVE-2026-632666.8LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document cou CVE-2026-632676.7LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while CVE-2026-632686.7LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name CVE-2026-632696.7LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HL CVE-2026-63274.3IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special CVE-2026-632706.7URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated CVE-2026-632725.4LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that ca CVE-2026-632735.4LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption CVE-2026-632745.4LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken CVE-2026-632755.4LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The n CVE-2026-632765.4LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embe