What is GHSA-wgm5-xp28-5cmg?

GHSA-wgm5-xp28-5cmg is a security advisory published by GitHub Security Advisories with Critical severity. Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5...

Which CVE IDs does GHSA-wgm5-xp28-5cmg cover?

GHSA-wgm5-xp28-5cmg covers the following CVE IDs: CVE-2026-74251. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-wgm5-xp28-5cmgCritical

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5...

Vendor

GitHub Security Advisories

Published

August 16, 2026

Last Modified

August 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-74251 →

📋 Description

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An unauthenticated attacker can inject arbitrary SQL through these parameters, enabling full database extraction via time-based blind techniques.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-74251
https://www.phoca.cz/phocacart
https://github.com/advisories/GHSA-wgm5-xp28-5cmg