CRITICAL 9.3 NVD

CVE-2026-74251

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET ar

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An unauthenticated attacker can inject arbitrary SQL through these parameters, enabling full database extraction via time-based blind techniques.

References

https://www.phoca.cz/phocacart

Published: 2026-08-16 · Source: NVD · Feed updated: 2026-08-16

This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-08-16 via NVD.

Risk Timeline

CVE Disclosed2026-08-16 · -1 days ago

Remediation Resources

Analysis & PoC

www.phoca.cz/phocacart

vulnfeed aggregates 11848 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.