CVE-2023-54360

Received Received - Intake

Reflected XSS in Joomla JLex Review 6.0.1 Enables Session Hijacking

Publication date: 2026-04-09

Last updated on: 2026-04-09

Assigner: VulnCheck

Description

Joomla JLex Review 6.0.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the review_id URL parameter. Attackers can craft malicious links containing JavaScript payloads that execute in victims' browsers when clicked, enabling session hijacking or credential theft.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-09

Last Modified

2026-04-09

Generated

2026-07-06

AI Q&A

2026-04-10

EPSS Evaluated

2026-07-05

NVD

CVE-2023-54360

Affected Vendors & Products

Vendor	Product	Version / Range
joomla	jlex_review	6.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a reflected cross-site scripting (XSS) issue in Joomla JLex Review version 6.0.1. It occurs because the application improperly handles the review_id URL parameter, allowing attackers to inject malicious scripts.

Attackers can create specially crafted links containing JavaScript code that executes in the browsers of users who click those links.

This execution can lead to session hijacking or theft of user credentials.

Impact Analysis

The vulnerability can impact you by allowing attackers to execute malicious scripts in your browser when you click on a crafted link.

This can result in session hijacking, where attackers take over your active session, or credential theft, where your login information is stolen.

Compliance Impact

The vulnerability in Joomla JLex Review 6.0.1 is a reflected cross-site scripting (XSS) issue that allows attackers to inject malicious scripts, potentially leading to session hijacking or credential theft.

Such security weaknesses can impact compliance with standards like GDPR and HIPAA because they may lead to unauthorized access to personal or sensitive data, violating data protection and privacy requirements.

However, specific effects on compliance depend on the context of data handled and the implementation of additional security controls.

Hi! I’m here to help you understand CVE-2023-54360. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70