CVE-2026-76602 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors...

CVE-2026-76602

Fabrik is a Joomla extension (fabrikar.com) that provides form and database management. In versions below 4.7.3 , the order parameter in list models is passed directly into database queries without validation, enabling unauthenticated SQL injection via the ORDER BY clause. This allows an attacker...

CVE-2026-76603 Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik 4.7.2 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users...

CVE-2026-76603 Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik 4.7.2 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users...

CVE-2026-76603

Fabrik (a Joomla extension by fabikar.com) versions prior to 4.7.3 contain an unauthenticated data disclosure vulnerability in the inlineedit form controller . The controller fails to perform any access checks, allowing unauthorized users to view row-level data through the form's inline edit endp...

EUVD-2026-64328

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik 4.7.3 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users...

CVE-2026-76571 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery. An unauthenticated attacker can supply arbitrary SQL through...

EUVD-2026-64327

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik 4.7.3 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery. An unauthenticated attacker can supply arbitrary SQL through...

CVE-2026-76571 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery. An unauthenticated attacker can supply arbitrary SQL through...

CVE-2026-76597 Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot...

CVE-2026-76598 Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjaxgetFolders in Fabrik 4.7.2 - The onAjaxgetFolders method of the elements model allows arbitrary directory listings...

CVE-2026-76598

Fabrik (a Joomla extension by fabrikar.com) versions prior to 4.7.2 are vulnerable to unauthenticated arbitrary directory listing via the onAjax_getFolders method in the elements model. An unauthenticated remote attacker can enumerate directory contents over the network with low complexity and no...

CVE-2026-76605 Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik 4.7.2...

EUVD-2026-64324

Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik 4.7.3 - ???...

CVE-2026-76605 Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik 4.7.2...

CVE-2026-76605

Fabrik is a Joomla extension (fabrikar.com) that is affected by a remote code execution vulnerability via its image element in versions prior to 4.7.3 . The flaw is network-exploitable with low complexity , requires no privileges and no user interaction , and carries a CVSS 4.0 score of 10.0 (Cri...

EUVD-2026-64323

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table...

CVE-2026-76596 Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table...

CVE-2026-76596 Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table...

CVE-2026-76596

Fabrik (Joomla extension by fabrikar.com) versions prior to 4.7.2 contain an unauthenticated table truncation vulnerability in the list.doempty endpoint. The list controller's doempty endpoints lack ACL gates , meaning a plain GET request from an unauthenticated attacker can empty the target list...