Fabrikar.com Fabrik Extension For Joomla
19 CVEs affecting Fabrikar.com Fabrik Extension For Joomla. Latest disclosed: 2026-08-22. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-77992 | | 2026-08-22 | Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access c… | |
CVE-2026-77027 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of user supplied input in the jsactions feature leads to an store… | |
CVE-2026-76609 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access check… | |
CVE-2026-76608 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any a… | |
CVE-2026-76607 | | 2026-08-22 | Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2. | |
CVE-2026-76606 | | 2026-08-22 | Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2. | |
CVE-2026-76605 | | 2026-08-22 | Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2. | |
CVE-2026-76604 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 - The PHP form element is vulnerable to the exec… | |
CVE-2026-76603 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The inineedit form controller does not perform any acc… | |
CVE-2026-76602 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without v… | |
CVE-2026-76601 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks. | |
CVE-2026-76600 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks. | |
CVE-2026-76599 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements mo… | |
CVE-2026-76598 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the ele… | |
CVE-2026-76597 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller… | |
CVE-2026-76596 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates… | |
CVE-2026-76571 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list… | |
CVE-2026-67282 | | 2026-08-12 | Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unauthenticated attacker could execute arbitrary code by using t… | |
CVE-2026-66915 | | 2026-08-10 | Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc fea… |