{"uuid": "acc1beec-05f2-4f79-864c-70851c4ecdea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76565", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117151851235145822", "content": "\u203c\ufe0f CVE PoC Published: CVE-2026-76565 - Reflected XSS in PhocaCart\nGitHub: https://github.com/toanln-cov/CVE-2026-76565\nA proof-of-concept has been released for CVE-2026-76565, a reflected cross-site scripting (XSS) vulnerability affecting PhocaCart \u2264 6.1.7 for Joomla.\nThe vulnerability exists in the price_from and price_to filter parameters within the mod_phocacart_filter module. Due to improper output encoding, unauthenticated attackers can craft a malicious URL that injects JavaScript into the page when viewed by a victim.\nThe PoC demonstrates:\n\u2022 Reflected XSS through crafted GET parameters\u2022 Exploitation of vulnerable price filter inputs\u2022 Attribute-context injection caused by missing htmlspecialchars() encoding\u2022 No authentication requirement for exploitation\u2022 Affected versions: PhocaCart \u2264 6.1.7\u2022 Fixed version: PhocaCart 6.1.8\n\ud83d\udca5 No delays. No guessing. No redactions. Get the intel before everyone else with Dark Web Informer.", "creation_timestamp": "2026-08-24T18:16:27.552813Z"}