CVE Feed

    Dashboard / CVE / CVE-2026-97165

    CVE-2026-97165

    Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated.

    Published:Sep 27, 2026
    Last Modified:Oct 27, 2026
    EPS:Sep 27, 2026
    EPSS Score:0.00244
    CVSS Score:6.1

    Affected Products

    Vendor
    Svenbluege
    Product
    Event Gallery
    Vendor
    Svenbluege.de
    Product
    Event Gallery For Joomla

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-102777 (CVSS 6.3) — Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery ex…
    CVE-2026-102778 (CVSS 5.3) — Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gall…
    CVE-2026-102776 (CVSS 5.1) — Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery ex…
    CVE-2026-100748 (CVSS 6.9) — Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0…
    CVE-2026-97164 (CVSS 7) — Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Galler…
    CVE-2026-100747 (CVSS 5.1) — Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an…
    CVE-2026-100749 (CVSS 5.1) — Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only o…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High