Live › vulnerability › CVE-2026-102787
Go to dashboardPhoca Download, a Joomla extension, does not protect its category management actions against cross-site request forgery in versions 3.1.0 through 6.1.5. An attacker can trick a logged-in administrator into submitting a request that changes download categories.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 10:31 UTC. All times on this page are UTC.
Sites running Phoca Download between 3.1.0 and 6.1.5 on Joomla, where an administrator with category management rights is logged in while visiting an attacker-controlled page. Sites without the extension, or without active backend administrator sessions, are less exposed. The sources do not describe the required role beyond administrator access.
No product ranges from the sources yet.
6.1.5 once the vendor publishes it (fixed version unknown in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5
This page as .md · .json · in your agent: get_signal("CVE-2026-102787")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.