CVE-2026-74251

creationtimestamp| type| source ---|---|--- 2026-08-16 13:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mt7deeuej423 2026-08-16 14:07:10+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mt7ecw4x6623 2026-08-16 14:34:28+00:00| seen|...

CVE-2026-74251 Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An...

CVE-2026-74251

The CVE affects Phoca Cart (Phoca.cz) on Joomla, specifically versions 5.0.0–6.1.16. The vulnerability is an unauthenticated SQL injection where a[] (attribute) and s[] (specification) GET parameters from Phoca Cart’s public shop items page are concatenated directly into SQL WHERE clauses without...