CVE-2026-102775

The Joomla Extension - phoca.cz (specifically Phoca Cart versions 5.0.0 - 6.1.8 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the order-file download endpoint. The application fails to validate provided d (download token) and o (order token) parameters against stored value...