What’s Vulnerable › Products
fabrikar.com Fabrik extension for Joomla vulnerabilities
19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.
Check whether your fabrikar.com Fabrik extension for Joomla version is affected
Latest fabrikar.com Fabrik extension for Joomla vulnerabilities
- CVE-2026-77992 — Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 (CVSS 9.5)
- CVE-2026-77027 — Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 (CVSS 8.6)
- CVE-2026-76609 — Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 (CVSS 6.9)
- CVE-2026-76608 — Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 (CVSS 6.9)
- CVE-2026-76607 — Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2 (CVSS 10.0)
- CVE-2026-76606 — Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2 (CVSS 10.0)
- CVE-2026-76605 — Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2 (CVSS 10.0)
- CVE-2026-76604 — Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 (CVSS 10.0)
- CVE-2026-76603 — Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 (CVSS 6.9)
- CVE-2026-76602 — Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 (CVSS 9.3)
- CVE-2026-76601 — Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 (CVSS 6.9)
- CVE-2026-76600 — Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 (CVSS 6.9)
- CVE-2026-76599 — Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 (CVSS 8.7)
- CVE-2026-76598 — Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 (CVSS 8.7)
- CVE-2026-76597 — Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 (CVSS 8.7)
- CVE-2026-76596 — Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2 (CVSS 8.7)
- CVE-2026-76571 — Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 (CVSS 9.3)
- CVE-2026-67282 — Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 (CVSS 10.0)
- CVE-2026-66915 — Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.7.2 (CVSS 10.0)