CVE-2023-54363

State: PUBLISHED · Published: 2026-04-09 · Updated: 2026-04-10 · Assigner: VulnCheck

Description

Joomla Solidres 2.13.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating multiple GET parameters including show, reviews, type_id, distance, facilities, categories, prices, location, and Itemid. Attackers can craft malicious URLs containing JavaScript payloads in these parameters to steal session tokens, login credentials, or manipulate site content when victims visit the crafted links.

CWE

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected

Solidres / Joomla Solidres — v=2.13.3 [affected]

CVSS

4.0 score=5.1 severity=MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
3.1 score=6.1 severity=MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://www.exploit-db.com/exploits/51638 exploit
http://solidres.com/ product
https://extensions.joomla.org/extension/vertical-markets/booking-a-reservations/solidres/ product
https://www.vulncheck.com/advisories/joomla-solidres-reflected-xss-via-multiple-parameters third-party-advisory

Source

cvelistV5-main/cves/2023/54xxx/CVE-2023-54363.json