Phoca.cz vulnerabilities
We track 5 vulnerabilities in Phoca.cz products across 4 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 5, 2026.
Latest Phoca.cz vulnerabilities
- 7.5 High severity
Phoca Cart extension for Joomla: Authorization Bypass Through User-Controlled Key
Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order tok
- 9.3 Critical severity
Phoca Cart extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses wit
- 8.2 High severity
Phoca Commander extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability.
- 8.8 High severity
phoca.cz Phoca Download extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to ful
- 9.2 Critical severity
phoca.cz - Phoca Commander for Joomla: Unrestricted Upload of File with Dangerous Type
An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows code execution via the unzip feature.