CVE-2026-102786EUVD-2026-109070GHSA-42XM-GWXC-XHG6
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Phoca Gallery extension for Joomla, developed by phoca.cz, is affected by this vulnerability. An authenticated user can inject malicious scripts that are stored and then run in other users' browsers, potentially allowing actions performed in their context or access to their session data.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5
Timeline
- CVE published
- First seen by cve.now
Affected versions
- phoca.cz Phoca Gallery extension for Joomla
4.5.0-6.1.5