EUVD-2026-48328
GHSA-r75c-j988-cwf5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reflected XSS requires no privileges and network delivery, but mandates user interaction; scope changes to browser context with low C and I impact.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
1DescriptionCVE.org
Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 1.0.0-6.0.9 - Improper validation of user inputs lead to a reflective XSS vulnerability.
AnalysisAI
Reflected XSS in Phoca Maps 1.0.0 through 6.0.9, a Joomla mapping extension by phoca.cz, allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL containing unsanitized input. The vulnerability stems from improper validation of user-supplied input that is reflected back into the HTTP response without adequate output encoding (CWE-79). No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects moderate impact limited by the mandatory active user interaction requirement.
Technical ContextAI
Phoca Maps is a Joomla CMS extension developed by phoca.cz (CPE: cpe:2.3:a:phoca.cz:phoca_maps_extension_for_joomla:*:*:*:*:*:*:*:*) that provides geographic mapping functionality to Joomla-based websites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a class of flaw where the application takes attacker-controlled data from an HTTP request parameter and embeds it into the HTML response without proper sanitization or output encoding. In a reflected XSS scenario, the malicious payload is not stored server-side; instead it travels in the URL or POST body, is processed by the Joomla extension's PHP code, and is echoed back into the rendered page - executing in the context of the victim's browser session. The affected version range spans from the initial release 1.0.0 through 6.0.9, suggesting the validation gap was present throughout the extension's lifespan.
RemediationAI
The primary remediation is to upgrade Phoca Maps to a version above 6.0.9; the vendor advisory at https://www.phoca.cz/phocamaps should be consulted to confirm the exact fixed release, as a specific patch version was not independently confirmed in the available data. If an immediate upgrade is not possible, consider removing or disabling the Phoca Maps extension entirely until patching is feasible - this eliminates the attack surface at the cost of losing mapping functionality. As an additional layer, web application firewall (WAF) rules targeting reflected XSS patterns on the affected extension's request parameters can reduce exploitability, though WAF bypass is possible and this should not substitute for patching. Joomla administrators should also enforce a Content Security Policy (CSP) header to restrict inline script execution, which would neutralize many reflected XSS payloads even if the underlying flaw remains. Note: disabling the extension or enforcing strict CSP may break legitimate page functionality and should be tested in a staging environment first.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today