Phoca Commander Extension For Joomla CVE-2026-65764

Q: What is the CVSS score of CVE-2026-65764?

CVE-2026-65764 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-49127 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-27 Joomla

GHSA-v9q9-7r4h-w6rp

XSS Phoca Commander Extension For Joomla Phoca Cz

5.1

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Joomla) · only source for this CVE.

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 09:21 vuln.today

DescriptionCVE.org

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability.

AnalysisAI

We need to produce a JSON object with all specified fields. Let's analyze the provided data.

CVE: CVE-2026-65764 Description: "Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability." CVSS Score: 5.1, CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N (CVSS 4.0). We have to assess our own CVSS 3.1 and 4.0 vectors. We'll derive from description and exploitation conditions. The description says reflected XSS, improper validation of user inputs. Typically Reflected XSS requires user interaction (UI:A in CVSS 4.0), and the CVSS provided shows UI:A (user interaction required). AV:N, PR:N (no privileges required), AC:L, AT:N for 4.0. Impact to vulnerable component: VC:L, VI:L, VA:L (low integrity, low availability? Actually XSS usually affects confidentiality and integrity, not availability. But here VC:L, VI:L, VA:L. Might be impact on user session, not system. We'll produce our own assessment. For CVSS 3.1, for reflected XSS we'd set AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N maybe, or scope unchanged. Often reflected XSS scope is unchanged, but if the vulnerable component is the web application itself, and impact is to the user (like stealing cookies), scope is unchanged. Many CVSS 3.1 vectors for reflective XSS: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N or AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. I'll assess based on typical XSS: require user to click a link, low integrity (inject script), low confidentiality (steal data). Availability N/L? Usually none, but here VA:L in CVSS4.0, so maybe there's some availability impact. Since it's reflected, maybe it can deface the page, but not availability of the system. I'll set C:L, I:L, A:N. Scope: unchanged because the vulnerability is in the web application, and the impact is on the same component (the user's browser interacting with the app, but scope is typically unchanged for reflected XSS where the malic