CVE-2026-65882 - Vulnerability Details - OpenCVE

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Joomdle.com	Joomdle Component For Joomla

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Joomdle.com	Joomdle Component For Joomla

References

Link	Providers
https://www.joomdle.com/

History

Tue, 28 Jul 2026 21:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Joomdle.com Joomdle.com joomdle Component For Joomla
Vendors & Products		Joomdle.com Joomdle.com joomdle Component For Joomla

Tue, 28 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector.
Title		Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1
Weaknesses		CWE-79
References		https://www.joomdle.com/

MITRE

Status: PUBLISHED

Assigner: Joomla

Published: 2026-07-28T12:35:06.238Z

Updated: 2026-07-28T19:21:35.706Z

Reserved: 2026-07-23T09:17:01.409Z

Link: CVE-2026-65882

Vulnrichment

Updated: 2026-07-28T19:21:28.777Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-28T20:34:48Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-65882", "assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "state": "PUBLISHED", "assignerShortName": "Joomla", "dateReserved": "2026-07-23T09:17:01.409Z", "datePublished": "2026-07-28T12:35:06.238Z", "dateUpdated": "2026-07-28T19:21:35.706Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "com_joomdle", "product": "Joomdle component for Joomla", "vendor": "joomdle.com", "versions": [{"status": "affected", "version": "0.7.0-3.0.1"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Krzysztof Zaj\u0105c, CERT PL"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector."}], "value": "Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-18", "descriptions": [{"lang": "en", "value": "CAPEC-18 XSS Targeting Non-Script Elements"}]}], "providerMetadata": {"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "shortName": "Joomla", "dateUpdated": "2026-07-28T12:35:06.238Z"}, "references": [{"tags": ["product"], "url": "https://www.joomdle.com/"}], "source": {"discovery": "UNKNOWN"}, "title": "Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T19:21:15.734964Z", "id": "CVE-2026-65882", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T19:21:35.706Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-65882", "assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "state": "PUBLISHED", "assignerShortName": "Joomla", "dateReserved": "2026-07-23T09:17:01.409Z", "datePublished": "2026-07-28T12:35:06.238Z", "dateUpdated": "2026-07-28T19:21:35.706Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "com_joomdle", "product": "Joomdle component for Joomla", "vendor": "joomdle.com", "versions": [{"status": "affected", "version": "0.7.0-3.0.1"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Krzysztof Zaj\u0105c, CERT PL"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector."}], "value": "Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-18", "descriptions": [{"lang": "en", "value": "CAPEC-18 XSS Targeting Non-Script Elements"}]}], "providerMetadata": {"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "shortName": "Joomla", "dateUpdated": "2026-07-28T12:35:06.238Z"}, "references": [{"tags": ["product"], "url": "https://www.joomdle.com/"}], "source": {"discovery": "UNKNOWN"}, "title": "Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-65882", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T19:21:15.734964Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T19:21:28.777Z"}}]}}