Today someone managed to inject code into my template by adding info into the cash files. The index.html in the uploads file was changed too.

What permissions should be set for the cache folder?

The cache folder needs to be writable by the server, but should not be writable by everyone. If the administrator of the server has it set up correctly the cache folder may run with no trouble with a chmod of 775. But some servers are not set up correctly (including shared host) and the folder may not be writable without a chmod of 777, which is for everyone.

I would suggest trying the above. But also install and use the protector module. No site is truly secure, but you can do all you can to make it more difficult to compromise.

Head over to Xoops Tips, where you will find many good suggestions to improve your security.

Best Regards,
Bananadude