CVE-2025-2127

Summary

CVE-2025-2127 is a recently disclosed cross-site scripting (XSS) vulnerability affecting the JoomlaUX JUX Real Estate 3.4.0 extension for Joomla. The issue lies within the /extensions/realestate/index.php/properties/list/list-with-sidebar/realties file, specifically an unknown function. Attackers can exploit this vulnerability by manipulating the Itemid/jp_yearbuilt argument to inject malicious scripts. This attack can be launched remotely, making it a significant security concern. Despite early notifications to the vendor, they have yet to respond or issue a patch. Public exploits for this vulnerability are now available, increasing the risk for potential attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.