CVE-2025-2127

MEDIUMNuclei

JoomlaUX JUX Real Estate realties cross site scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-2127 has a selected CVSS score of 5.3 (medium); EIP currently links 1 Nuclei template.

Description

A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jp_yearbuilt leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 10, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

JUX Real Estate

Browse JoomlaUX / JUX Real Estate
CVE List3.4.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMJoomlaUX JUX Real Estate 3.4.0 - Reflected XSSCVSS 4.3

A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jp_yearbuilt leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

Attackers can inject malicious JavaScript through the Itemid and jp_yearbuilt parameters, potentially stealing user session cookies, redirecting users to malicious sites, or performing unauthorized actions in the context of authenticated users.

Remediation

Upgrade to the latest patched version of JUX Real Estate that properly sanitizes user input.

WeaknessesCWE-79
Authors3th1c_yuk1
Template tagscvecve2025joomlauxjoomlavuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CPE: cpe:2.3:a:joomlaux:jux_real_estate:3.4.0:*:*:*:*:joomla:*:*
FOFA: body="joomlaux"
https://nvd.nist.gov/vuln/detail/CVE-2025-2127 https://vuldb.com/?id.299040 https://vuldb.com/?ctiid.299040

Source: ProjectDiscovery

References

4