Phoca
5 articles tagged Phoca, newest first.
Phoca Download 6.1.6 adds the token check its file delete was missing
Phoca Download 6.1.6 fixes CVE-2026-102787, a CSRF flaw in front-end publish, unpublish and delete. Joomla 5 installs it by hand, Joomla 3 and 4 have no fix.
Phoca Gallery 6.1.6 fixes a stored XSS hidden in a photo's EXIF data
Phoca Gallery 4.5.0 to 6.1.5 lets a crafted image's EXIF data run script on the photo info view. 6.1.6 fixes it on Joomla 6 only; Joomla 4 and 5 are stranded.
Phoca Cart 6.1.9 stops anyone downloading other customers' paid files
Phoca Cart before 6.1.9 let anonymous visitors download the digital products other customers bought. Only the Joomla 6 line is fixed, and 6.1.8 is affected.
Phoca Cart 5.2.4, 6.1.7 and 4.0.13 fix a front-end SQL injection
Phoca Cart 5.2.4, 6.1.7 and 4.0.13 patch an unauthenticated SQL injection in the Joomla extension's product filter. Joomla 5 on 6.x isn't offered it.
Phoca Download 6.1.3 Fixes an Authenticated Upload RCE
Phoca Download for Joomla (com_phocadownload) up to 6.1.2 let a logged-in member upload a PHP file and run code on the server. Fixed in 6.1.3, update now.