Vulnerabilities

TI-2026-81067 CVE-2026-102787 · GHSA-fv3x-82q7-fxc6

CSRF in category management in Phoca Download Joomla extension

LOW 29

Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00165 Published 2026-10-27 No fix listed CWE-352

TI-2026-79940 CVE-2026-102786 · GHSA-42xm-gwxc-xhg6

Stored cross-site scripting in Phoca Gallery for Joomla

LOW 39

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00262 Published 2026-10-23 No fix listed CWE-79

TI-2026-67747 CVE-2026-102775 · GHSA-6qrr-hhgq-84g9

Authorization bypass in Phoca Cart lets users download customer files

MEDIUM 44

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00371 Published 2026-10-05 No fix listed CWE-639

TI-2026-53508 CVE-2026-76564 · GHSA-98mw-pj3j-99v2

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7

MEDIUM 40

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00436 Published 2026-08-20 No fix listed CWE-79

TI-2026-53510 CVE-2026-76569 · GHSA-99wr-9r6w-w242

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4

LOW 30

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00436 Published 2026-08-20 No fix listed CWE-79

TI-2026-53509 CVE-2026-76565 · GHSA-2m94-2f44-8q5p

Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7

LOW 30

Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00436 Published 2026-08-20 No fix listed CWE-79

TI-2026-52036 CVE-2026-74251 · GHSA-wgm5-xp28-5cmg

SQL injection in phoca.cz Phoca Cart extension for Joomla

MEDIUM 48

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are con…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0042 Published 2026-08-16 No fix listed CWE-89

TI-2026-47239 CVE-2026-66491 · GHSA-xj92-38c4-rf5r

Path traversal in phoca.cz Phoca Commander extension for Joomla

LOW 36

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability.

CVSS 4.0HIGH 8.2 Network High privileges No interaction EPSS 0.00468 Published 2026-08-07 No fix listed CWE-22

TI-2026-47240 CVE-2026-66492 · GHSA-7c99-cx95-2fcq

Path traversal in phoca.cz Phoca Commander extension for Joomla

LOW 28

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability.

CVSS 4.0MEDIUM 6.1 Network High privileges No interaction EPSS 0.00557 Published 2026-08-07 No fix listed CWE-22

TI-2026-47241 CVE-2026-66493 · GHSA-fcf9-29pq-pgc6

Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3

LOW 29

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities.

CVSS 4.0MEDIUM 6.4 Network High privileges No interaction EPSS 0.00468 Published 2026-08-07 No fix listed CWE-22

TI-2026-46859 CVE-2026-65765 · GHSA-c8m7-7389-gq73

Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.1

LOW 31

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00468 Published 2026-07-27 No fix listed CWE-22

TI-2026-46858 CVE-2026-65764 · GHSA-v9q9-7r4h-w6rp

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.1

LOW 24

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00436 Published 2026-07-27 No fix listed CWE-79

TI-2026-46856 CVE-2026-65762 · GHSA-576p-fvmq-q54x

Cross-site scripting in phoca.cz Phoca Guestbook extension for Joomla

LOW 24

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerability.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00436 Published 2026-07-23 No fix listed CWE-79

TI-2026-46857 CVE-2026-65763 · GHSA-r75c-j988-cwf5

Cross-site scripting in phoca.cz Phoca Maps extension for Joomla

LOW 24

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs lead to a reflective XSS vulnerability.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00436 Published 2026-07-23 No fix listed CWE-79

TI-2026-41646 CVE-2026-57828 · GHSA-wjv4-xh6c-w4j7

Unrestricted file upload in phoca.cz Phoca Download extension for Joomla

MEDIUM 42

Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users upl…

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.00543 Published 2026-07-11 No fix listed CWE-434

TI-2026-19256 CVE-2026-23900 · GHSA-p4gj-pp28-43q4

Extension - phoca.cz - Stored XSS vectors in Phoca Maps component 5.0.0 - 6.0.2 for Joomla

LOW 28

Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00248 Published 2026-04-11 No fix listed CWE-79

TI-2025-34270 CVE-2025-54473 · GHSA-gwjg-r9g6-4q23

Unrestricted file upload in phoca.cz - Phoca Commander for Joomla

MEDIUM 42

An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered.

CVSS 4.0CRITICAL 9.2 Network High privileges No interaction EPSS 0.00445 Published 2025-08-15 No fix listed CWE-434

TI-2009-00669 CVE-2009-0702 · GHSA-97mm-h3hh-grcf

SQL injection vulnerability in the Phoca Documentation (com_phocadocumentation) component…

LOW 35

SQL injection vulnerability in the Phoca Documentation (com_phocadocumentation) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a section action to index.php.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.00993 Published 2009-02-23 No fix listed CWE-89

Vulnerabilities

Filters