EUVD-2026-64326

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot...

CVE-2026-76597

Fabrik (a Joomla extension by fabrikar.com) versions prior to 4.7.2 contain an unauthenticated arbitrary file upload vulnerability in the list email plugin controller , which allows an attacker to upload non-executable files to the web root without authentication. The CVSS 4.0 score is 8.7 (HIGH)...

CVE-2026-76598

Fabrik (a Joomla extension by fabrikar.com) versions prior to 4.7.2 are vulnerable to unauthenticated arbitrary directory listing via the onAjax_getFolders method in the elements model. An unauthenticated remote attacker can enumerate directory contents over the network with low complexity and no...

EUVD-2026-64325

Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjaxgetFolders in Fabrik 4.7.2 - The onAjaxgetFolders method of the elements model allows arbitrary directory listings...

CVE-2026-76596

Fabrik (Joomla extension by fabrikar.com) versions prior to 4.7.2 contain an unauthenticated table truncation vulnerability in the list.doempty endpoint. The list controller's doempty endpoints lack ACL gates , meaning a plain GET request from an unauthenticated attacker can empty the target list...

EUVD-2026-64323

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table...

CVE-2026-76600

Fabrik (a Joomla extension by fabrikar.com) versions prior to 4.7.2 are affected by an unauthenticated comment deletion vulnerability. The DeleteComment endpoint performed no access checks, allowing any unauthenticated network attacker to delete any comment. The CVSS 4.0 base score is 6.9 (MEDIUM...

EUVD-2026-64321

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik 4.7.2 - The DeleteComment endpoint did not perform any access checks...

CVE-2026-76604 Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik 4.7.2 - The PHP form element is vulnerable to the execution of user provided codes...

EUVD-2026-64320

Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik 4.7.3 - The PHP form element is vulnerable to the execution of user provided codes...

CVE-2026-76604

Fabrik is a Joomla extension (by fabrikar.com) that allows building forms and databases. In versions below 4.7.3 , the PHP form element permits execution of user-supplied code, enabling unauthenticated remote code execution over the network with no user interaction required. The CVSS 4.0 score is...

EUVD-2026-64318

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...

CVE-2026-76609

Fabrik is a Joomla extension that provides form and data management capabilities. In versions prior to 4.7.2 , the onUpdateComment endpoint lacked any access control checks, allowing an unauthenticated attacker over the network to modify any comment. The CVSS 4.0 base score is 6.9 (MEDIUM) , refl...

EUVD-2026-64317

Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik 4.7.2 - The onGetEmail endpoint did not perform any access checks...

CVE-2026-76608

Fabrik is a Joomla extension that provides form and database functionality. In versions prior to 4.7.2 , the onGetEmail endpoint lacked any access control checks, allowing an unauthenticated attacker to disclose the email address of any commenter. This constitutes an information disclosure vulner...

CVE-2026-76599

CVE-2026-76599 affects the Fabrik Joomla Extension in versions below 4.7.2 . The ajax_tables method of the elements model allows an unauthenticated attacker to list arbitrary database tables, including their column definitions, and to disclose the database table prefix. This information disclosur...

EUVD-2026-64316

Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik 4.7.2 - The ajaxtables method of the elements model allows listings of arbitrary database tables including columns...

CVE-2026-76601

Fabrik is a Joomla extension developed by fabrikar.com. In versions prior to 4.7.2 , the order plugin did not perform any access checks, allowing unauthenticated row reordering of data. An attacker can exploit this over the network without credentials or user interaction to alter the ordering of ...

EUVD-2026-64315

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik 4.7.2 - The order plugin did not perform any access checks...

CVE-2026-2996

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to and including 1.6.21 . The root cause is a logic flaw in the validate_cart_data function, which allows unauthenticated attackers to bypass required pa...