Paper/Archive/CVE-2026-74251

CVE-2026-74251

phoca.cz Phoca Cart extension for Joomla — Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6

EPSS 0.4%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 36.3.363 × 207.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An unauthenticated attacker can inject arbitrary SQL through these parameters, enabling full database extraction via time-based blind techniques.

Affected

ProductAffectedFixed inSource

Phoca Cart extension for Joomla5.0.0-6.1.6–CNA

Scores by source

Joomla (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refphoca.cz/phocacart