{"id":"CVE-2026-23900","aliases":["EUVD-2026-21678","GHSA-p4gj-pp28-43q4"],"status":"published","title":"Extension - phoca.cz - Stored XSS vectors in Phoca Maps component 5.0.0 - 6.0.2 for Joomla","description":"Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00253,"percentile":0.16908,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-04-11T12:52:12Z","modified":"2026-10-28T02:30:51Z","products":[{"vendor":"phoca","product":"maps"},{"vendor":"phoca.cz","product":"phoca.cz - phoca maps for joomla"}],"references":[{"url":"https://phoca.cz/","tags":["product","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23900"},{"url":"https://phoca.cz"},{"url":"https://github.com/advisories/GHSA-p4gj-pp28-43q4"}],"sources":{"cve":[{"id":"CVE-2026-23900","title":"Extension - phoca.cz - Stored XSS vectors in Phoca Maps component 5.0.0 - 6.0.2 for Joomla","description":"Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.","status":"published","published":"2026-04-11T12:52:12.525Z","modified":"2026-04-14T05:14:12.556Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:42:15.603999Z"}],"euvd":[{"id":"EUVD-2026-21678","description":"Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.","status":"published","published":"2026-04-11T12:52:12Z","modified":"2026-04-14T05:14:12Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:27.052992Z"}],"ghsa":[{"id":"GHSA-p4gj-pp28-43q4","title":"Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component...","description":"Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.","status":"published","published":"2026-04-11T15:30:24Z","modified":"2026-04-13T18:31:44Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:07:26.169567Z"}],"nvd":[{"id":"CVE-2026-23900","description":"Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.","status":"published","published":"2026-04-11T14:16:03.377Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:14.37744Z"}],"osv":[{"id":"CVE-2026-23900","description":"Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.","status":"published","published":"2026-04-11T14:16:03.377Z","modified":"2026-10-28T02:30:51.781481193Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:59.079784Z"}]}}