CVE-2026-63281

MediumCVSS 4.8/10Last modified Oct 24, 2026

Description

Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/JavaScript in administrator summaries.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 22, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-63296.5PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched MCVE-2026-632927.5Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remCVE-2026-632939.9A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importCVE-2026-632949.9A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpackinCVE-2026-632954.3An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. WhenCVE-2026-632969.9An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migratioCVE-2026-632979.9An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass taCVE-2026-632989.9An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attackeCVE-2026-632999.9An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code pCVE-2026-63306.5The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection anCVE-2026-633009.9An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker wCVE-2026-633017.0In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the int