CVE-2026-74251: critical vulnerability in phoca.cz Phoca Cart extension for Joomla
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6
Published · Updated
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.3epss 0.4%
from disclosure to weapon1 days
Published on NVDAug 16
1st PoC+1d
exploitation probability
0.4%top 66% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An unauthenticated attacker can inject arbitrary SQL through these parameters, enabling full database extraction via time-based blind techniques.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
phoca.cz · Phoca Cart extension for Joomlapublic PoCs found — 1
githubgithub.com/toanln-cov/CVE-2026-74251★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — phoca.cz Phoca Cart extension for Joomla
In the same product, most dangerous first.
CVE-2026-76564HIGHJoomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7EPSS 0.4%CVE-2026-76565MEDIUMJoomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7EPSS 0.4%CVE-2026-102775HIGHJoomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8EPSS 0.4%
References
https://www.phoca.cz/phocacart