Phoca Cart extension for Joomla vulnerabilities

2 known vulnerabilities in Phoca Cart extension for Joomla from Phoca.cz. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Phoca Cart extension for Joomla: Authorization Bypass Through User-Controlled Key

  CVE-2026-102775Oct 5, 2026Phoca.cz

  Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order tok

• 9.3 Critical severity

  Phoca Cart extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-74251Aug 16, 2026Phoca.cz

  Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses wit