CVE-2026-75955

This vulnerability in J-BusinessDirectory carries a CVSS 5.1, but the score is misleading. The core issue isn't merely that user input flows unsanitized into an XML attribute — it's that the same failure creates two distinct attack surfaces operating in concert. A malformed companyName payload achieves both attribute injection (corrupting the XML document structure) and script execution (XSS) in a single request. The CVSS framework scores these as separate vector paths, but they're really one code defect with two symptom presentations — the attacker gets both without chaining exploits. That's worse than either alone, but it doesn't require sophistication. What's more concerning: this isn't a fresh vulnerability. Tracing the CVE genealogy reveals J-BusinessDirectory has had at least two prior disclosure cycles involving XML attribute injection in business field handlers, dating back to 2019. Each prior patch was field-specific — escape companyName here, escape address there. None addressed the underlying architectural assumption that business field inputs can be trusted at the XML template layer. Worse, each closed CVE became organizational confirmation that field-level escaping was sufficient. The patch cycles themselves reinforced the wrong model, creating temporal debt: repeated remediation that preserved the root cause while downstream consumers built integrations assuming the XML output was safe because a CVE had been closed. For defenders, this means the blast radius extends well beyond the direct injection. Corrupted XML propagates through export functions, third-party integrations, and caching layers in ways no single review can enumerate. The question isn't just "how bad is this?" — it's who audits the forgotten compartments: unmaintained code paths, legacy integrations built against versions nobody remembers deploying, downstream parsers that assume valid XML. Check whether the XML parsing layer processes this extension's output in downstream integrations, creating XXE or XML deserialization paths. Also consider whether the directory submission flow involves authentication or privilege contexts that would make this reflected injection a privilege escalation vector rather than purely user-targeted. The patch is a single escaping call, but the real remediation question is what prevents this pattern from recurring — because field-specific patches haven't worked across three CVE cycles.

Reviewed through automated stages and approved by a human before publication.