Phoca vulnerabilities
We track 2 vulnerabilities in Phoca products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 5, 2026.
2vulnerabilities
0critical
2high
0exploited
8.2average CVSS score
Latest Phoca vulnerabilities
- 7.5 High severity
Phoca Cart extension for Joomla: Authorization Bypass Through User-Controlled Key
Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order tok
- 8.8 High severity
phoca.cz Phoca Download extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to ful