Phoca Download Extension For Joomla
Monthly
Reflected XSS in the Phoca Download Extension for Joomla (versions 5.0.0 through 6.1.4) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL containing a payload in the 'search' GET parameter. Exploitation requires social engineering to lure a victim into clicking the crafted link, after which the attacker can steal session tokens, perform actions on behalf of the victim, or redirect to malicious sites. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Reflected XSS in the Phoca Download Extension for Joomla (versions 5.0.0 through 6.1.4) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL containing a payload in the 'search' GET parameter. Exploitation requires social engineering to lure a victim into clicking the crafted link, after which the attacker can steal session tokens, perform actions on behalf of the victim, or redirect to malicious sites. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.