{"vulnerability": "CVE-2026-74251", "sightings": [{"uuid": "815bdae6-dec2-454d-b1a1-7b040eeb5e1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74251", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt7deeuej423", "content": "CVE-2026-74251 - phoca cart extension for joomla\nThe Phoca Cart extension for Joomla has a security issue that allows an attacker to access sensitive information in the database. This can happen when a user visits a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#phocacz #CVE #infosec", "creation_timestamp": "2026-08-16T13:50:05.252215Z"}, {"uuid": "930a5e6a-9e14-4157-94aa-6cb8a4c3c58e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74251", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mt7ecw4x6623", "content": "\ud83d\udea8 CVE-2026-74251 \u2014 CVSS 9.3 CRITICAL\n\nJoomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.16...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-74251\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-16T14:07:10.073868Z"}, {"uuid": "4c4260cc-c65c-4d8f-a725-bdbbccc61b07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74251", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mt7ftqjdzx25", "content": "Phoca Cart, a Joomla store extension, has a critical flaw (CVE-2026-74251) that lets anyone read the shop's whole database, no login needed.\n\nCustomer records and password hashes are exposed on the public shop page.\n\nAffects 5.0.0 to 6.1.6. Fixed in 6.1.7. Update now.", "creation_timestamp": "2026-08-16T14:34:28.744209Z"}, {"uuid": "a7026b92-4f83-4c25-9cfe-06eb8d250d30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74251", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/47e5nnaikipyw", "content": "CVE-2026-74251 - Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.16\nCVE ID : CVE-2026-74251\n \n Published : Aug. 16, 2026, 1:16 p.m. | 56\u00a0minutes ago\n \n Description : Joomla Extension - phoca.cz - Unauthenticated SQL inje...", "creation_timestamp": "2026-08-16T15:00:38.308066Z"}, {"uuid": "57698fa7-866c-49d1-baf4-2a5ab1007b46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-74251", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117108613380665635", "content": "CVE-2026-74251: Phoca Cart (Joomla ext. v5.0.0 \u2013 6.1.16) suffers CRITICAL SQL injection via unauthenticated a[]/s[] params. Full DB extraction possible. Patch status unclear \u2014 check vendor. https://radar.offseq.com/threat/cve-2026-74251-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-a5081e610a943a93 #OffSeq #SQLInjection #Joomla #Infosec", "creation_timestamp": "2026-08-17T03:00:29.644472Z"}, {"uuid": "560388f1-a436-4a2a-ae0c-a5641b9c302b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-74251", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtapjrrsns2w", "content": "Phoca Cart for Joomla (v5.0.0 \u2013 6.1.16) hit by CRITICAL unauthenticated SQL injection \u2014 full DB at risk. Patch status unknown; check vendor. https://radar.offseq.com/threat/cve-2026-74251-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-a5081e610a943a93 #Off...", "creation_timestamp": "2026-08-17T03:00:32.031316Z"}, {"uuid": "3b5ef626-b104-43fb-b27c-6e32755448ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74251", "type": "seen", "source": "https://bsky.app/profile/cybersecinsight.bsky.social/post/3mtbmk2g6m72a", "content": "\ud83d\udd0d Vulnerability Spotlight | Part 2/3\n\n\u26a0\ufe0f CVE-2026-74251\n\nJoomla Extension - phoca.cz -  Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specific...", "creation_timestamp": "2026-08-17T11:39:38.593651Z"}, {"uuid": "dbe4bca0-0a34-469e-b0fd-39b8b69d271a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74251", "type": "seen", "source": "Telegram/V7oTBRUbkXzaHvYy2QQxFpYYbPBlxoSiyiRu3UGCulCLojY", "content": "", "creation_timestamp": "2026-08-17T18:00:04.239741Z"}, {"uuid": "87188b22-2a54-4bfe-990a-5d4c08e84627", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74251", "type": "seen", "source": "Telegram/2zSHnWnjNO3Na1wVQn9SXZ4BXbp1iBqREE5RdHe5T4MRT7s", "content": "", "creation_timestamp": "2026-08-17T18:00:04.557898Z"}, {"uuid": "72b0bd07-69ea-4778-8c24-53f93755a1a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74251", "type": "published-proof-of-concept", "source": "Telegram/2zSHnWnjNO3Na1wVQn9SXZ4BXbp1iBqREE5RdHe5T4MRT7s", "content": "", "creation_timestamp": "2026-08-18T00:00:12.288159Z"}, {"uuid": "0910521b-deb3-41fa-8130-8ed077eb5ffb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74251", "type": "published-proof-of-concept", "source": "Telegram/V7oTBRUbkXzaHvYy2QQxFpYYbPBlxoSiyiRu3UGCulCLojY", "content": "", "creation_timestamp": "2026-08-18T00:00:12.486816Z"}, {"uuid": "7c29f297-47f1-4e5c-ae4e-a0b310d3954e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74251", "type": "seen", "source": "https://t.me/GithubRedTeam/98395", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-74251\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a toanln-cov\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-17 02:55:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated SQL Injection via Attribute Filter in Phoca Cart\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-22T19:00:07.945628Z"}, {"uuid": "e4f0e704-c249-45b0-9dc8-6862c3ffcf87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74251", "type": "seen", "source": "https://t.me/GithubRedTeam/98395", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-74251\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a toanln-cov\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-17 02:55:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated SQL Injection via Attribute Filter in Phoca Cart\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-23T00:00:32.587930Z"}, {"uuid": "ab62dc67-c01b-4989-a39d-720ffb8b0c58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74251", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/98395", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-74251\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a toanln-cov\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-17 02:55:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated SQL Injection via Attribute Filter in Phoca Cart\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-24T00:00:11.235647Z"}]}