What’s Vulnerable › Vulnerabilities
CVE-2026-76571: Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2
- Severity: critical (CVSS 9.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-22 · updated 2026-10-23
- Weakness: CWE-89
Description
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database.
Affected products
- fabrikar.com Fabrik extension for Joomla: 1.0.0-4.7.1
References
Get alerted when CVE-2026-76571 or the next vulnerability affects your stack