CVE-2026-65764

Phoca Commander versions 5.0.0 to 6.1.1 are vulnerable to a reflected cross-site scripting (XSS) attack due to improper validation of user inputs. This vulnerability allows attackers to inject malicious scripts that can execute in the context of the user's browser, potentially leading to session hijacking or data theft. Joomla administrators using these versions should prioritize patching to mitigate the risk of exploitation.