CVE-2026-76603

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik 4.7.2 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users...

CVE-2026-76605

Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik 4.7.2...

CVE-2026-76601

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik 4.7.2 - The order plugin did not perform any access checks...

CVE-2026-76604

Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik 4.7.2 - The PHP form element is vulnerable to the execution of user provided codes...

CVE-2026-76607

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.2...

CVE-2026-76598

Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjaxgetFolders in Fabrik 4.7.2 - The onAjaxgetFolders method of the elements model allows arbitrary directory listings...

CVE-2026-76600

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik 4.7.2 - The DeleteComment endpoint did not perform any access checks...

CVE-2026-76571

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery. An unauthenticated attacker can supply arbitrary SQL through...

CVE-2026-76596

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table...

CVE-2026-76599

Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik 4.7.2 - The ajaxtables method of the elements model allows listings of arbitrary database tables including columns...

CVE-2026-76606 Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik 4.7.2...

EUVD-2026-64331

Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik 4.7.3 - ???...

CVE-2026-76606

Fabrik is a Joomla extension that is vulnerable to path traversal via its image element in versions prior to 4.7.3 . The CVSS 4.0 base score is 10.0 (CRITICAL) , indicating network-exploitable impact with no required privileges or user interaction, affecting confidentiality, integrity, and availa...

CVE-2026-76606 Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik 4.7.2...

EUVD-2026-64330

Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik 4.7.2 - The handling of user supplied input in the jsactions feature leads to an stored XSS vector...

CVE-2026-77027 Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik 4.7.2 - The handling of user supplied input in the jsactions feature leads to an stored XSS vector...

CVE-2026-77027

CVE-2026-77027 affects the Fabrik Joomla extension (versions below 4.7.2 ). The vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in the jsactions feature, caused by improper handling of user-supplied input. An attacker can inject malicious scripts that execute in the con...

CVE-2026-76602 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors...

CVE-2026-76602 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors...

EUVD-2026-64329

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik 4.7.3 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors...