Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 19

Export CSV
CVE-2026-76603

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-76599

Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements model allows listings of arbitrary database tables including columns.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-76571

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-77027

Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of user supplied input in the jsactions feature leads to an stored XSS vector.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-76606

Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-76605

Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-76602

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-76598

Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the elements model allows arbitrary directory listings.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-76597

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-76596

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-77992

Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-76600

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-76604

Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 - The PHP form element is vulnerable to the execution of user provided codes.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-76607

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-76609

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-76608

Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any access checks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-76601

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-66915

Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the calc plugin.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla
CVE-2026-67282

Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8

Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unauthenticated attacker could execute arbitrary code by using the frontend listfilter model.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Fabrikar.com
Products
Fabrik Extension For Joomla