CVE-2026-74251

The CVE affects Phoca Cart (Phoca.cz) on Joomla, specifically versions 5.0.0–6.1.16. The vulnerability is an unauthenticated SQL injection where a[] (attribute) and s[] (specification) GET parameters from Phoca Cart’s public shop items page are concatenated directly into SQL WHERE clauses without...

CVE-2026-74251

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An...

CVE-2026-74251 Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An...

EUVD-2026-58806

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check...

CVE-2026-71571

Technical details are not publicly available in the provided documents. Monitor for updates from official sources.

EUVD-2026-58804

Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL...

CVE-2026-67286

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name...

CVE-2026-67287 Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input...

CVE-2026-67287

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input...

CVE-2026-67286 Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name...

CVE-2026-67286

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name...

CVE-2026-67286 Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name...

CVE-2026-67286

CVE-2026-67286 affects the Joomla extension for SP Page Builder by joomshaper.com prior to version 6.8.0. The issue allows an unauthenticated attacker to create arbitrary directories and write files using a predefined name, enabling potential local impact on the affected site. The provided metric...

CVE-2026-67285 Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system...

CVE-2026-67285

SP Page Builder (Joomla extension) from joomshaper.com is affected by an unauthenticated local PHP file inclusion in versions before 6.8.0. The issue allows an unauthenticated attacker to include arbitrary PHP files accessible by the system. CVSS metrics indicate a high impact on confidentiality,...

CVE-2026-67285 Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system...

CVE-2026-67284

Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud 2.0.3 - Authenticated users could perform various file-related operations read, delete, overwrite, re-assign permissions on files owned by other users...

CVE-2026-67284

Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud 2.0.3 - Authenticated users could perform various file-related operations read, delete, overwrite, re-assign permissions on files owned by other users...

CVE-2026-67284 Joomla Extension - tabaoca.org - Improper ACL checks allow file operations in Cotton Cloud < 2.0.2

Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud 2.0.3 - Authenticated users could perform various file-related operations read, delete, overwrite, re-assign permissions on files owned by other users...

CVE-2026-67284

CVE-2026-67284 affects the Joomla extension from tabaoca.org, with an improper ACL implementation that allows authenticated users to perform file operations (read, delete, overwrite, re-assign permissions) on files owned by other users in Cotton Cloud versions older than 2.0.3. The incident is do...