CVE-2026-102787

MediumCVSS 5.3

Published: 27/10/2026(UTC)Updated: 27/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5.

Risk Assessment

An attacker could trick a logged-in administrator into performing unwanted category operations, potentially modifying or damaging the site configuration.

Recommendation

Update Phoca Download to a version later than 6.1.5 containing the CSRF fix, or implement additional CSRF protections.

Other vulnerabilities in Phoca Download

CVE-2026-76569Medium
The Joomla extension Phoca Download versions 5.0.0-6.1.4 contains a Reflected XSS vulnerability via the 'search' GET parameter.

Original NVD description (English source)

Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5

Vulnerability data from NVD (NIST) · CISA KEV · EPSS