CVE-2023-54360
Reflected XSS in Joomla JLex Review 6.0.1 Enables Session Hijacking
Publication date: 2026-04-09
Last updated on: 2026-04-09
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| joomla | jlex_review | 6.0.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a reflected cross-site scripting (XSS) issue in Joomla JLex Review version 6.0.1. It occurs because the application improperly handles the review_id URL parameter, allowing attackers to inject malicious scripts.
Attackers can create specially crafted links containing JavaScript code that executes in the browsers of users who click those links.
This execution can lead to session hijacking or theft of user credentials.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to execute malicious scripts in your browser when you click on a crafted link.
This can result in session hijacking, where attackers take over your active session, or credential theft, where your login information is stolen.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Joomla JLex Review 6.0.1 is a reflected cross-site scripting (XSS) issue that allows attackers to inject malicious scripts, potentially leading to session hijacking or credential theft.
Such security weaknesses can impact compliance with standards like GDPR and HIPAA because they may lead to unauthorized access to personal or sensitive data, violating data protection and privacy requirements.
However, specific effects on compliance depend on the context of data handled and the implementation of additional security controls.