EUVD-2026-63215
GHSA-98mw-pj3j-99v2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No privileges required to inject (PR:N), admin must view order (UI:R), payload executes in admin browser context crossing security boundaries (S:C), with high C and I impact on that privileged session.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7
AnalysisAI
Stored XSS in Phoca Cart (Joomla extension by phoca.cz, versions 5.0.0-6.1.7) allows any unauthenticated network attacker to inject a persistent JavaScript payload via a crafted HTTP User-Agent header submitted during order creation. The payload is stored in the order database and executes in the Joomla administrator's browser when they open the Admin Order View, placing admin sessions at risk of hijacking or credential theft. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target site runs Phoca Cart version 5.0.0 through 6.1.7 as a Joomla extension, and that the attacker can submit any request that creates an order - a capability available to any unauthenticated visitor to the storefront. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L) captures the key risk profile accurately: the attack is network-reachable, requires no privileges, imposes no special attack requirements, and carries high confidentiality and integrity impact, with the sole friction being that an administrator must actively open the malicious order (UI:A). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker submits a purchase on a vulnerable Phoca Cart storefront, setting the HTTP User-Agent header to a JavaScript payload such as a cookie-exfiltration script targeting document.cookie. When a Joomla administrator next opens the Admin Order View to process orders - a routine daily task - the stored payload executes silently in their browser, sending the admin's session token to an attacker-controlled endpoint. … |
| Remediation | Check the vendor's official page at https://www.phoca.cz/phocacart for a patched release addressing this stored XSS; no specific fixed version number was confirmed in the available intelligence data, so administrators should monitor that page directly for an update beyond 6.1.7. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit recent orders for suspicious User-Agent headers and deploy WAF rules to sanitize or block script-like User-Agent patterns; restrict admin panel access to known corporate IP ranges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in Phoca Cart, an e-commerce extension for Joomla, allows unauthenticated remote attackers to extract the
Reflected cross-site scripting in Phoca Cart, a Joomla e-commerce extension by phoca.cz, affects versions 5.0.0 through
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today