Skip to content

Exploited: 178

LatestCVE-2022-29966 — Emerson Ovation Missing Authentication for Critical Functionality

8.6

CVE-2026-102786Verify fix

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5

phoca.cz Phoca Gallery extension for Joomla2026-10-23 14:34 UTC1 min readRead in

Summary

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5

Remediation

Inventory every phoca.cz Phoca Gallery extension for Joomla deployment, including staging.
No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

Referencehttps://www.phoca.cz/

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Affected versions

Version	Fixed in
4.5.0-6.1.5	None yet

Weakness

CWE-79

Exploit probability (EPSS)

0.3%

Timeline

2026-10-23Publicly disclosed

Sources

CVE · NVD