Phoca Gallery Extension For Joomla
Monthly
Stored cross-site scripting in Phoca Gallery 4.5.0 through 6.1.5 allows an attacker who can create or edit gallery content to inject HTML attributes that execute in a victim's browser when the affected gallery page is viewed. The vendor/EUVD CVSS 4.0 base score is 8.6, while our independent CVSS 3.1 assessment uses PR:L/UI:R and rates impact as low confidentiality/integrity with scope change. No public exploit identified at time of analysis, and vuln.today assigns a this_week decision label.
Stored cross-site scripting in Phoca Gallery 4.5.0 through 6.1.5 allows an attacker who can create or edit gallery content to inject HTML attributes that execute in a victim's browser when the affected gallery page is viewed. The vendor/EUVD CVSS 4.0 base score is 8.6, while our independent CVSS 3.1 assessment uses PR:L/UI:R and rates impact as low confidentiality/integrity with scope change. No public exploit identified at time of analysis, and vuln.today assigns a this_week decision label.