CVE-2026-76597 Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot...

CVE-2026-76597 Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot...

EUVD-2026-64326

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot...

CVE-2026-76597

Fabrik (a Joomla extension by fabrikar.com) versions prior to 4.7.2 contain an unauthenticated arbitrary file upload vulnerability in the list email plugin controller , which allows an attacker to upload non-executable files to the web root without authentication. The CVSS 4.0 score is 8.7 (HIGH)...

CVE-2026-76598 Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjaxgetFolders in Fabrik 4.7.2 - The onAjaxgetFolders method of the elements model allows arbitrary directory listings...

CVE-2026-76598

Fabrik (a Joomla extension by fabrikar.com) versions prior to 4.7.2 are vulnerable to unauthenticated arbitrary directory listing via the onAjax_getFolders method in the elements model. An unauthenticated remote attacker can enumerate directory contents over the network with low complexity and no...

EUVD-2026-64325

Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjaxgetFolders in Fabrik 4.7.2 - The onAjaxgetFolders method of the elements model allows arbitrary directory listings...

CVE-2026-76598 Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjaxgetFolders in Fabrik 4.7.2 - The onAjaxgetFolders method of the elements model allows arbitrary directory listings...

CVE-2026-76605 Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik 4.7.2...

EUVD-2026-64324

Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik 4.7.3 - ???...

CVE-2026-76605 Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik 4.7.2...

CVE-2026-76605

Fabrik is a Joomla extension (fabrikar.com) that is affected by a remote code execution vulnerability via its image element in versions prior to 4.7.3 . The flaw is network-exploitable with low complexity , requires no privileges and no user interaction , and carries a CVSS 4.0 score of 10.0 (Cri...

CVE-2026-76604 Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik 4.7.2 - The PHP form element is vulnerable to the execution of user provided codes...

EUVD-2026-64320

Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik 4.7.3 - The PHP form element is vulnerable to the execution of user provided codes...

CVE-2026-76604 Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik 4.7.2 - The PHP form element is vulnerable to the execution of user provided codes...

CVE-2026-76604

Fabrik is a Joomla extension (by fabrikar.com) that allows building forms and databases. In versions below 4.7.3 , the PHP form element permits execution of user-supplied code, enabling unauthenticated remote code execution over the network with no user interaction required. The CVSS 4.0 score is...

DEBIAN-CVE-2026-71513

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft...

CVE-2026-4561

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-71513

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft...

CVE-2026-75866

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and granttypes per client and documents both as client registration. token dispatches...