Description
An issue was discovered in Joomla! 3.9.0 through 3.9.23. The lack of escaping in mod_breadcrumbs aria-label attribute allows XSS attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Joomla! Project | Joomla! CMS | 3.9.0-3.9.23 | — |
Unscored
CVE-2021-23124
EUVD-2021-10242GHSA-mhvc-g5wh-hrxg
[20210102] - Core - XSS in mod_breadcrumbs aria-label attribute
Published Jan 12, 2021 · Updated Feb 25, 2026 · Assigned by Joomla