Tomasz Kowalski

**Name of the Vulnerable Software and Affected Versions** DJ-ArtGallery (com djartgallery) version 0.9.1 for Joomla! **Description** The issue allows remote attackers to inject arbitrary web script or HTML via the `cid[]` parameter in an editItem action to "administrator/index.php". This is a cross-site scripting (XSS) issue. **Recommendations** For DJ-ArtGallery (com djartgallery) version 0.9.1, avoid using the `cid[]` parameter in the editItem action to administrator/index.php until a fix is available. As a temporary workaround, consider restricting access to the administrator/index.php endpoint to minimize the risk of exploitation.