Phoca Cart (com_phocacart) 3.x - Unauthenticated SQL Injection in the product filter, no fixed release (CVE-2026-74251)
Phoca Cart builds the product filter query by concatenating the a (attribute) and s (specification) request parameters straight into the WHERE clause inside hand-written quotes, instead of passing them through the database quoting. The front-end product listing model reads both parameters from the request using the Joomla array filter, which does not sanitise the values inside the array, so any anonymous visitor can reach the injection on a public product or category listing page with no account and no token. Phoca fixed this on 16 August 2026 in 5.2.4 (Joomla 5 line) and 6.1.7 (Joomla 6 line). The Joomla 3 line was NOT patched: 3.5.8 is the newest 3.x release and it still contains the identical vulnerable code, so every 3.x version is affected with no fixed release available. There is no in-branch remedy. Migrate the site to a supported Joomla version and install the patched Phoca Cart, or remove the extension. The Joomla CNA published CVE-2026-74251 for this flaw on 16 August 2026, scoring it CVSS 4.0 9.3 Critical (CWE-89). The published affected range starts at 5.0.0, so it does not formally cover the 3.x branch, but we extracted 3.5.8 and confirmed the identical unpatched code, which is why this rule flags it.
Affected versions: ≥ 3.0.0 and < 4.0.0
Full advisory: our disclosure post
Phoca Cart (com_phocacart) below 4.0.13 - Unauthenticated SQL Injection in the product filter (CVE-2026-74251)
Phoca Cart builds the product filter query by concatenating the a (attribute) and s (specification) request parameters straight into the WHERE clause inside hand-written quotes, instead of passing them through the database quoting. The front-end product listing model reads both parameters from the request using the Joomla array filter, which does not sanitise the values inside the array, so any anonymous visitor can reach the injection on a public product or category listing page with no account and no token. Phoca fixed this on 16 August 2026 across three branches: 6.1.7 at 10:23 UTC, 5.2.4 sixteen minutes later, and 4.0.13 for the Joomla 4 line the same evening at 20:39 UTC. Update to 4.0.13 or later on the 4.x branch. The fix is in admin/libraries/phocacart/search/search.php and routes every filter value through $db->quote(); we confirmed it by extracting and diffing the shipped com_phocacart_v4.0.12.zip and com_phocacart_v4.0.13.zip packages rather than comparing git tags, which do not correspond to the released code on this project. The 4.x file has four injection points where the 5.x and 6.x files have six, because the 4.x line predates the multilingual code path. The Joomla CNA published CVE-2026-74251 on 16 August 2026, scoring it CVSS 4.0 9.3 Critical (CWE-89). The published affected range starts at 5.0.0 and does not formally cover the 4.x branch, but the identical vulnerable code is present in 4.0.12 and earlier, which is why this rule flags it.
Affected versions: ≥ 4.0.0 and < 4.0.13
Full advisory: our disclosure post
Phoca Cart (com_phocacart) below 5.2.4 - Unauthenticated SQL Injection in the product filter (CVE-2026-74251)
Phoca Cart builds the product filter query by concatenating the a (attribute) and s (specification) request parameters straight into the WHERE clause inside hand-written quotes, instead of passing them through the database quoting. The front-end product listing model reads both parameters from the request using the Joomla array filter, which does not sanitise the values inside the array, so any anonymous visitor can reach the injection on a public product or category listing page with no account and no token. Update to Phoca Cart 5.2.4 or later on the Joomla 5 line. Note that Joomla 5 sites running a Phoca Cart 6.x version will NOT be offered this fix by the Joomla updater, because the update feed maps Joomla 5 to the 5.x release and 5.2.4 sorts lower than the installed 6.x version, so the update screen shows nothing: those sites need the 6.1.7 package installed manually. The Joomla CNA published CVE-2026-74251 for this flaw on 16 August 2026, scoring it CVSS 4.0 9.3 Critical (CWE-89).
Affected versions: ≥ 5.0.0 and < 5.2.4
Full advisory: our disclosure post
Phoca Cart (com_phocacart) below 6.1.7 - Unauthenticated SQL Injection in the product filter (CVE-2026-74251)
Phoca Cart builds the product filter query by concatenating the a (attribute) and s (specification) request parameters straight into the WHERE clause inside hand-written quotes, instead of passing them through the database quoting. The front-end product listing model reads both parameters from the request using the Joomla array filter, which does not sanitise the values inside the array, so any anonymous visitor can reach the injection on a public product or category listing page with no account and no token. Update to Phoca Cart 6.1.7 or later. If this site runs Joomla 5 rather than Joomla 6, the Joomla updater will NOT offer 6.1.7: the update feed maps Joomla 5 to the 5.x release and 5.2.4 sorts lower than the installed 6.x version, so the update screen reports nothing to update. Download the 6.1.7 package from GitHub or phoca.cz and install it through Extensions, Install, Upload Package File. The Joomla CNA published CVE-2026-74251 for this flaw on 16 August 2026, scoring it CVSS 4.0 9.3 Critical (CWE-89). The record states the affected range as 5.0.0-6.1.16; there is no Phoca Cart 6.1.16, the highest release on the 6.x line is 6.1.7 and that is the build containing the fix, so read the upper bound as 6.1.6.
Affected versions: ≥ 6.0.0 and < 6.1.7
Full advisory: our disclosure post
Phoca Cart (com_phocacart) 6.1.7 - Unauthenticated Reflected XSS in the product price filter
Phoca Cart echoes the price_from and price_to request parameters straight into the value attribute of the product filter text inputs, in the site layouts form_filter_text.php and form_filter_horizontal_text.php, with no escaping. No login is required: a crafted link to a shop category or product list page whose price_from value contains a double quote breaks out of the attribute and runs attacker script in the browser of anyone who opens it. The filter panel is rendered on the public shop pages whenever the price filter is enabled. 6.1.8 wraps both values in htmlspecialchars with ENT_QUOTES and ENT_SUBSTITUTE, and also escapes an unescaped value in the administrator Phoca Render Adminview helper. Confirmed by diffing the released com_phocacart zips on 2026-08-18. Update to 6.1.8. Note that 6.1.7 was itself the fix for the CVE-2026-74251 product filter SQL injection, so a site on 6.1.7 is exposed to this cross site scripting issue only, not to the SQL injection.
Affected versions: ≥ 6.1.7 and < 6.1.8
Full advisory: github.com
Medium
Phoca Cart (com_phocacart) 5.2.4 - Unauthenticated Reflected XSS in the product price filter, no fixed 5.x release
Phoca Cart echoes the price_from and price_to request parameters straight into the value attribute of the product filter text inputs, in the site layouts form_filter_text.php and form_filter_horizontal_text.php, with no escaping. No login is required: a crafted link to a shop category or product list page whose price_from value contains a double quote breaks out of the attribute and runs attacker script in the browser of anyone who opens it. The filter panel is rendered on the public shop pages whenever the price filter is enabled. 6.1.8 wraps both values in htmlspecialchars with ENT_QUOTES and ENT_SUBSTITUTE, and also escapes an unescaped value in the administrator Phoca Render Adminview helper. Confirmed by diffing the released com_phocacart zips on 2026-08-18. The escaping fix has so far shipped on the 6.x branch only, in 6.1.8. Version 5.2.4 is the current 5.x release, and the released com_phocacart_v5.2.4.zip was checked on 2026-08-18 and still ships both filter layouts unescaped, so there is no fixed 5.x release yet. Move to 6.1.8 if the site can run the 6.x branch, otherwise disable the price filter until Phoca backports the fix. Versions below 5.2.4 are already flagged for the CVE-2026-74251 SQL injection.
Affected versions: ≥ 5.2.4 and ≤ 5.2.4
Full advisory: github.com
Running Phoca Cart on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
CVE identifiers: CVE-2026-74251, CVE-2026-76564, CVE-2026-76565. Rules current as of 13 September 2026.