CVE-2026-76571criticalCWE-89

CVE-2026-76571: falha crítica em fabrikar.com Fabrik extension for Joomla

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Fabrik extension for Joomla

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.4%
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
fabrikar.com · Fabrik extension for Joomla
CVEs relacionadas — fabrikar.com Fabrik extension for Joomla

No mesmo produto, das mais perigosas para as menos.

CVE-2026-66915CRITICALJoomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.7.2EPSS 0.8%CVE-2026-67282CRITICALJoomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8EPSS 0.8%CVE-2026-76605CRITICALJoomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2EPSS 0.7%CVE-2026-76604CRITICALJoomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2EPSS 0.7%CVE-2026-76606CRITICALJoomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2EPSS 0.5%CVE-2026-76598HIGHJoomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2EPSS 0.5%