CVE-2026-78302

HighCVSS 8.6/10Last modified Sep 10, 2026

Description

Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4 - Multiple template files across frontend views and administrator list tables rendered attributes and text values directly into HTML without contextual escaping.

Metrics

CVSS 4.0 8.6/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 10, 2026
Last modified: Sep 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-783036.9Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking i CVE-2026-783068.5DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi co CVE-2026-783089.8Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass. This issue affects DIAEnergie: before 1.11.00.022.CVE-2026-783098.8SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.CVE-2026-78317.6UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConne CVE-2026-783104.3Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.CVE-2026-783118.8SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.CVE-2026-783129.1Path Traversal in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.CVE-2026-783136.5Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.CVE-2026-783148.8SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.CVE-2026-783158.8SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.CVE-2026-783168.8SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.