CVE-2026-65764
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability.
Risk Assessment
The organization risks that an attacker can inject a malicious script into the page that executes in the victim's browser, potentially leading to session theft, redirection to malicious sites, or data theft.
Recommendation
Update Phoca Commander to a version above 6.1.1 that fixes the input validation, or apply the available patch.
Other vulnerabilities in Phoca Commander
See all- CVE-2026-66493Medium
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities.
- CVE-2026-66492Medium
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability.
- CVE-2026-66491High
Arbitrary file read vulnerability in Phoca Commander 1.0.0-6.1.3 for Joomla. Improper limitation of paths in the getSource function leads to arbitrary file read.
- CVE-2026-65765Medium
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities.
Original NVD description (English source)
Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability.