CVE-2026-76569

MediumCVSS 5.3

Published: 20/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

The Joomla extension Phoca Download versions 5.0.0-6.1.4 contains a Reflected XSS vulnerability via the 'search' GET parameter.

An attacker can inject a malicious script that executes in the victim's browser, leading to session theft or other unauthorized actions.

Update Phoca Download to the latest version that includes a fix for this vulnerability.

Original NVD description (English source)

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4

Vulnerability data from NVD (NIST) · CISA KEV · EPSS