Vulnerability · Published Mar 9, 2025 · Assigned by VulDB
CVE-2025-2127JoomlaUX JUX Real Estate realties cross site scripting
Medium 4.3
In plain English
A medium-severity cross-site scripting in JUX Real Estate from JoomlaUX. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jp_yearbuilt leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| JoomlaUX | JUX Real Estate | 3.4.0 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- VDB-299040 | JoomlaUX JUX Real Estate realties cross site scripting vdb-entry, technical-description
- VDB-299040 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #509891 | JoomlaUX JUX Real Estate 3.4.0 Reflected XSS third-party-advisory