Phoca Cz
Monthly
Stored XSS in Phoca Cart (Joomla extension by phoca.cz, versions 5.0.0-6.1.7) allows any unauthenticated network attacker to inject a persistent JavaScript payload via a crafted HTTP User-Agent header submitted during order creation. The payload is stored in the order database and executes in the Joomla administrator's browser when they open the Admin Order View, placing admin sessions at risk of hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in Phoca Cart, an e-commerce extension for Joomla, allows unauthenticated remote attackers to extract the entire database via the public shop items page. Versions 5.0.0 through 6.1.16 concatenate the a[] (attribute) and s[] (specification) GET array parameters directly into SQL WHERE clauses, so an attacker can dump credentials and order data using time-based blind techniques. No public exploit identified at time of analysis, but the flaw is trivially reachable and rated CVSS 4.0 9.3 (Critical).
Phoca Commander (Joomla file manager extension by phoca.cz, versions 1.0.0-6.1.3) exposes arbitrary server-side files through a path traversal flaw in its getSource function, allowing attackers with Joomla administrator credentials to read files outside the extension's intended directory scope - including sensitive configuration files, credentials, and system files. The CVSS 4.0 score of 8.2 reflects a high confidentiality impact on both the vulnerable system (VC:H) and subsequent systems (SC:H), meaning the disclosure can extend beyond the Joomla application boundary to the underlying server filesystem. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, making active exploitation unconfirmed at time of analysis.
Arbitrary file upload in the Phoca Download extension for Joomla lets any authenticated registered user upload executable files (e.g. PHP) that the server will run, yielding full remote code execution. The flaw is scored 9.0 (CVSS 4.0) and is exploitable over the network by low-privilege accounts, so any site permitting self-registration is directly at risk. A public technical write-up describing the RCE technique exists, though no active exploitation has been confirmed by CISA KEV.
Reflected XSS in the Phoca Download Extension for Joomla (versions 5.0.0 through 6.1.4) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL containing a payload in the 'search' GET parameter. Exploitation requires social engineering to lure a victim into clicking the crafted link, after which the attacker can steal session tokens, perform actions on behalf of the victim, or redirect to malicious sites. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Reflected cross-site scripting in Phoca Cart, a Joomla e-commerce extension by phoca.cz, affects versions 5.0.0 through 6.1.7 via the price_from and price_to URL filter parameters. An unauthenticated remote attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser session. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Path traversal in Phoca Commander (a Joomla file manager extension by phoca.cz) versions 1.0.0 through 6.1.3 allows high-privileged authenticated users to write uploaded files to arbitrary filesystem locations outside the intended upload directory, achieving high integrity impact on the underlying server. The CVSS 4.0 vector (PR:H/SI:H) confirms that while exploitation requires administrator-level Joomla access, a successful attack can affect the server filesystem beyond the Joomla webroot - enabling PHP shell planting or overwriting sensitive configuration files. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is known at time of analysis.
Path traversal in Phoca Commander (Joomla file manager extension by phoca.cz) versions 1.0.0 through 6.1.3 enables authenticated Joomla administrators to escape intended directory boundaries during delete, copy, and move file operations, reaching arbitrary locations on the host filesystem. The CVSS 4.0 vector confirms high subsequent-system impact (SC:H/SI:H/SA:H) with no direct impact on the extension itself, meaning successful exploitation threatens the broader server environment rather than just the Joomla installation. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal vulnerability in the Phoca Commander Joomla extension allows authenticated administrators to read arbitrary files on the server via crafted save and download requests. Affected versions are 1.0.0 through 6.1.1. No active exploitation has been reported, and no public exploit code is known.
We need to produce a JSON object with all specified fields. Let's analyze the provided data. CVE: CVE-2026-65764 Description: "Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability." CVSS Score: 5.1, CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N (CVSS 4.0). We have to assess our own CVSS 3.1 and 4.0 vectors. We'll derive from description and exploitation conditions. The description says reflected XSS, improper validation of user inputs. Typically Reflected XSS requires user interaction (UI:A in CVSS 4.0), and the CVSS provided shows UI:A (user interaction required). AV:N, PR:N (no privileges required), AC:L, AT:N for 4.0. Impact to vulnerable component: VC:L, VI:L, VA:L (low integrity, low availability? Actually XSS usually affects confidentiality and integrity, not availability. But here VC:L, VI:L, VA:L. Might be impact on user session, not system. We'll produce our own assessment. For CVSS 3.1, for reflected XSS we'd set AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N maybe, or scope unchanged. Often reflected XSS scope is unchanged, but if the vulnerable component is the web application itself, and impact is to the user (like stealing cookies), scope is unchanged. Many CVSS 3.1 vectors for reflective XSS: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N or AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. I'll assess based on typical XSS: require user to click a link, low integrity (inject script), low confidentiality (steal data). Availability N/L? Usually none, but here VA:L in CVSS4.0, so maybe there's some availability impact. Since it's reflected, maybe it can deface the page, but not availability of the system. I'll set C:L, I:L, A:N. Scope: unchanged because the vulnerability is in the web application, and the impact is on the same component (the user's browser interacting with the app, but scope is typically unchanged for reflected XSS where the malic
Reflected XSS in the Phoca Guestbook Joomla extension (versions 1.0.0 through 6.1.0) allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser via crafted, unsanitized URL parameters or form inputs reflected back by the extension without proper encoding. Exploitation requires the victim to click a specially crafted link (UI:A per CVSS 4.0), making phishing or social engineering the primary delivery mechanism. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Reflected XSS in Phoca Maps 1.0.0 through 6.0.9, a Joomla mapping extension by phoca.cz, allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL containing unsanitized input. The vulnerability stems from improper validation of user-supplied input that is reflected back into the HTTP response without adequate output encoding (CWE-79). No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects moderate impact limited by the mandatory active user interaction requirement.
Stored XSS vulnerabilities in Phoca Maps for Joomla 5.0.0-6.0.2 allow unauthenticated remote attackers to inject and execute arbitrary JavaScript in map and icon rendering logic, potentially compromising user sessions and stealing sensitive data. CVSS 6.5 reflects network accessibility and information disclosure risk, though EPSS (0.03%) suggests low current exploitation likelihood. The vulnerability requires no authentication or user interaction to inject payloads, but stored nature means victims are affected upon viewing contaminated maps.
Stored XSS in Phoca Cart (Joomla extension by phoca.cz, versions 5.0.0-6.1.7) allows any unauthenticated network attacker to inject a persistent JavaScript payload via a crafted HTTP User-Agent header submitted during order creation. The payload is stored in the order database and executes in the Joomla administrator's browser when they open the Admin Order View, placing admin sessions at risk of hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in Phoca Cart, an e-commerce extension for Joomla, allows unauthenticated remote attackers to extract the entire database via the public shop items page. Versions 5.0.0 through 6.1.16 concatenate the a[] (attribute) and s[] (specification) GET array parameters directly into SQL WHERE clauses, so an attacker can dump credentials and order data using time-based blind techniques. No public exploit identified at time of analysis, but the flaw is trivially reachable and rated CVSS 4.0 9.3 (Critical).
Phoca Commander (Joomla file manager extension by phoca.cz, versions 1.0.0-6.1.3) exposes arbitrary server-side files through a path traversal flaw in its getSource function, allowing attackers with Joomla administrator credentials to read files outside the extension's intended directory scope - including sensitive configuration files, credentials, and system files. The CVSS 4.0 score of 8.2 reflects a high confidentiality impact on both the vulnerable system (VC:H) and subsequent systems (SC:H), meaning the disclosure can extend beyond the Joomla application boundary to the underlying server filesystem. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, making active exploitation unconfirmed at time of analysis.
Arbitrary file upload in the Phoca Download extension for Joomla lets any authenticated registered user upload executable files (e.g. PHP) that the server will run, yielding full remote code execution. The flaw is scored 9.0 (CVSS 4.0) and is exploitable over the network by low-privilege accounts, so any site permitting self-registration is directly at risk. A public technical write-up describing the RCE technique exists, though no active exploitation has been confirmed by CISA KEV.
Reflected XSS in the Phoca Download Extension for Joomla (versions 5.0.0 through 6.1.4) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL containing a payload in the 'search' GET parameter. Exploitation requires social engineering to lure a victim into clicking the crafted link, after which the attacker can steal session tokens, perform actions on behalf of the victim, or redirect to malicious sites. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Reflected cross-site scripting in Phoca Cart, a Joomla e-commerce extension by phoca.cz, affects versions 5.0.0 through 6.1.7 via the price_from and price_to URL filter parameters. An unauthenticated remote attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser session. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Path traversal in Phoca Commander (a Joomla file manager extension by phoca.cz) versions 1.0.0 through 6.1.3 allows high-privileged authenticated users to write uploaded files to arbitrary filesystem locations outside the intended upload directory, achieving high integrity impact on the underlying server. The CVSS 4.0 vector (PR:H/SI:H) confirms that while exploitation requires administrator-level Joomla access, a successful attack can affect the server filesystem beyond the Joomla webroot - enabling PHP shell planting or overwriting sensitive configuration files. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is known at time of analysis.
Path traversal in Phoca Commander (Joomla file manager extension by phoca.cz) versions 1.0.0 through 6.1.3 enables authenticated Joomla administrators to escape intended directory boundaries during delete, copy, and move file operations, reaching arbitrary locations on the host filesystem. The CVSS 4.0 vector confirms high subsequent-system impact (SC:H/SI:H/SA:H) with no direct impact on the extension itself, meaning successful exploitation threatens the broader server environment rather than just the Joomla installation. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal vulnerability in the Phoca Commander Joomla extension allows authenticated administrators to read arbitrary files on the server via crafted save and download requests. Affected versions are 1.0.0 through 6.1.1. No active exploitation has been reported, and no public exploit code is known.
We need to produce a JSON object with all specified fields. Let's analyze the provided data. CVE: CVE-2026-65764 Description: "Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability." CVSS Score: 5.1, CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N (CVSS 4.0). We have to assess our own CVSS 3.1 and 4.0 vectors. We'll derive from description and exploitation conditions. The description says reflected XSS, improper validation of user inputs. Typically Reflected XSS requires user interaction (UI:A in CVSS 4.0), and the CVSS provided shows UI:A (user interaction required). AV:N, PR:N (no privileges required), AC:L, AT:N for 4.0. Impact to vulnerable component: VC:L, VI:L, VA:L (low integrity, low availability? Actually XSS usually affects confidentiality and integrity, not availability. But here VC:L, VI:L, VA:L. Might be impact on user session, not system. We'll produce our own assessment. For CVSS 3.1, for reflected XSS we'd set AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N maybe, or scope unchanged. Often reflected XSS scope is unchanged, but if the vulnerable component is the web application itself, and impact is to the user (like stealing cookies), scope is unchanged. Many CVSS 3.1 vectors for reflective XSS: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N or AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. I'll assess based on typical XSS: require user to click a link, low integrity (inject script), low confidentiality (steal data). Availability N/L? Usually none, but here VA:L in CVSS4.0, so maybe there's some availability impact. Since it's reflected, maybe it can deface the page, but not availability of the system. I'll set C:L, I:L, A:N. Scope: unchanged because the vulnerability is in the web application, and the impact is on the same component (the user's browser interacting with the app, but scope is typically unchanged for reflected XSS where the malic
Reflected XSS in the Phoca Guestbook Joomla extension (versions 1.0.0 through 6.1.0) allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser via crafted, unsanitized URL parameters or form inputs reflected back by the extension without proper encoding. Exploitation requires the victim to click a specially crafted link (UI:A per CVSS 4.0), making phishing or social engineering the primary delivery mechanism. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Reflected XSS in Phoca Maps 1.0.0 through 6.0.9, a Joomla mapping extension by phoca.cz, allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL containing unsanitized input. The vulnerability stems from improper validation of user-supplied input that is reflected back into the HTTP response without adequate output encoding (CWE-79). No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects moderate impact limited by the mandatory active user interaction requirement.
Stored XSS vulnerabilities in Phoca Maps for Joomla 5.0.0-6.0.2 allow unauthenticated remote attackers to inject and execute arbitrary JavaScript in map and icon rendering logic, potentially compromising user sessions and stealing sensitive data. CVSS 6.5 reflects network accessibility and information disclosure risk, though EPSS (0.03%) suggests low current exploitation likelihood. The vulnerability requires no authentication or user interaction to inject payloads, but stored nature means victims are affected upon viewing contaminated maps.