Phoca Download Extension For Joomla
Monthly
Cross-site request forgery in Phoca Download for Joomla 3.1.0 through 6.1.5 allows a remote attacker to induce a logged-in administrator or category-management user to submit forged category-management actions, with limited integrity and availability impact and no confidentiality disclosure. The CVSS vector is network-reachable with no attacker privileges, but exploitation depends on a privileged victim's active browser session and interaction; EPSS is 0.21% (12th percentile), no public exploit is identified at time of analysis, and the priority is this_month. This is a moderate, low-priority issue rather than an emergency.
Reflected XSS in the Phoca Download Extension for Joomla (versions 5.0.0 through 6.1.4) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL containing a payload in the 'search' GET parameter. Exploitation requires social engineering to lure a victim into clicking the crafted link, after which the attacker can steal session tokens, perform actions on behalf of the victim, or redirect to malicious sites. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Cross-site request forgery in Phoca Download for Joomla 3.1.0 through 6.1.5 allows a remote attacker to induce a logged-in administrator or category-management user to submit forged category-management actions, with limited integrity and availability impact and no confidentiality disclosure. The CVSS vector is network-reachable with no attacker privileges, but exploitation depends on a privileged victim's active browser session and interaction; EPSS is 0.21% (12th percentile), no public exploit is identified at time of analysis, and the priority is this_month. This is a moderate, low-priority issue rather than an emergency.
Reflected XSS in the Phoca Download Extension for Joomla (versions 5.0.0 through 6.1.4) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL containing a payload in the 'search' GET parameter. Exploitation requires social engineering to lure a victim into clicking the crafted link, after which the attacker can steal session tokens, perform actions on behalf of the victim, or redirect to malicious sites. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.