CVE-2026-76602 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors...

CVE-2026-76602

Fabrik is a Joomla extension (fabrikar.com) that provides form and database management. In versions below 4.7.3 , the order parameter in list models is passed directly into database queries without validation, enabling unauthenticated SQL injection via the ORDER BY clause. This allows an attacker...

PT-2026-79578

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.3 Description An unauthenticated SQL injection exists in the list models where the order parameter is used in queries without proper validation. This allows attackers to use read SQLi vectors to extract information...