CVE-2026-77027

Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik 4.7.2 - The handling of user supplied input in the jsactions feature leads to an stored XSS vector...

CVE-2026-76606

Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik 4.7.2...

CVE-2026-76604

Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik 4.7.2 - The PHP form element is vulnerable to the execution of user provided codes...

CVE-2026-76607

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.2...

CVE-2026-76603

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik 4.7.2 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users...

CVE-2026-76602

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors...

CVE-2026-76605

Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik 4.7.2...

CVE-2026-76571

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery. An unauthenticated attacker can supply arbitrary SQL through...

EUVD-2026-64331

Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik 4.7.3 - ???...

CVE-2026-76606

Fabrik is a Joomla extension that is vulnerable to path traversal via its image element in versions prior to 4.7.3 . The CVSS 4.0 base score is 10.0 (CRITICAL) , indicating network-exploitable impact with no required privileges or user interaction, affecting confidentiality, integrity, and availa...

CVE-2026-76606 Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik 4.7.2...

EUVD-2026-64330

Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik 4.7.2 - The handling of user supplied input in the jsactions feature leads to an stored XSS vector...

CVE-2026-77027 Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik 4.7.2 - The handling of user supplied input in the jsactions feature leads to an stored XSS vector...

CVE-2026-77027

CVE-2026-77027 affects the Fabrik Joomla extension (versions below 4.7.2 ). The vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in the jsactions feature, caused by improper handling of user-supplied input. An attacker can inject malicious scripts that execute in the con...

CVE-2026-76602 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors...

EUVD-2026-64329

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik 4.7.3 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors...

CVE-2026-76602

Fabrik is a Joomla extension (fabrikar.com) that provides form and database management. In versions below 4.7.3 , the order parameter in list models is passed directly into database queries without validation, enabling unauthenticated SQL injection via the ORDER BY clause. This allows an attacker...

EUVD-2026-64328

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik 4.7.3 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users...

CVE-2026-76603

Fabrik (a Joomla extension by fabikar.com) versions prior to 4.7.3 contain an unauthenticated data disclosure vulnerability in the inlineedit form controller . The controller fails to perform any access checks, allowing unauthorized users to view row-level data through the form's inline edit endp...

CVE-2026-76603 Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik 4.7.2 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users...