Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| High | 8.6 | CVE-2026-102786 |
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5
phoca.czphoca.cz Phoca Gallery extension for Joomla, phoca.cz Phoca Gallery
|
NVD | |||
|
CVE-2026-102786Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5
Executive summaryThe advisory describes a stored cross-site scripting flaw in the Phoca Gallery Joomla extension, versions 4.5.0 through 6.1.5, which the advisory title says can be exploited by an authenticated user. The text supplied does not state a severity rating. The page points to Phoca Gallery version 6.1.6 as a security release, which is the update the vendor recommends. Technical summaryThe flaw is stored cross-site scripting caused by HTML attribute injection, and the title says it requires an authenticated user. The affected range is given as 4.5.0 through 6.1.5 in the title, and the fixed version is 6.1.6 per the news item about the security release. The advisory does not state a CVSS score, exploitation status in the wild, or a workaround. Detailed technical information, proof of concept, and detection guidance are not included in the text supplied, and the news item only says Read more for details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from phoca.cz Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affectsphoca.czphoca.cz Phoca Gallery extension for Joomlaphoca.cz Phoca Gallery
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-102775 |
Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does...
phoca.cz, Phocaphoca.cz Phoca Cart extension for Joomla, Phoca Cart
|
NVD | |||
|
CVE-2026-102775Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does...
From the advisoryJoomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user (including a guest with no account at all) can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens. Impact if exploitedConfidentialityHigh IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affectsphoca.czPhocaphoca.cz Phoca Cart extension for JoomlaPhoca Cart
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||