Veille CVE

Recherche « fabrikar.com Fabrik extension for Joomla »

19 CVE

Critique 9 Élevée 5 Moyenne 5 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « fabrikar.com Fabrik extension for Joomla » ✕
  1. CVE-2026-77992 9.5 Critique

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.

  2. CVE-2026-77027 8.6 Élevée

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of user supplied input in the jsactions feature leads to an stored XSS vector.

  3. CVE-2026-76609 6.9 Moyenne

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.

  4. CVE-2026-76608 6.9 Moyenne

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any access checks.

  5. CVE-2026-76607 10.0 Critique

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2.

  6. CVE-2026-76606 10.0 Critique

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.

  7. CVE-2026-76605 10.0 Critique

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2.

  8. CVE-2026-76604 10.0 Critique

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 - The PHP form element is vulnerable to the execution of user provided codes.

  9. CVE-2026-76603 6.9 Moyenne

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users.

  10. CVE-2026-76602 9.3 Critique

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors.

  11. CVE-2026-76601 6.9 Moyenne

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks.

  12. CVE-2026-76600 6.9 Moyenne

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks.

  13. CVE-2026-76599 8.7 Élevée

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements model allows listings of arbitrary database tables including columns.

  14. CVE-2026-76598 8.7 Élevée

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the elements model allows arbitrary directory listings.

  15. CVE-2026-76597 8.7 Élevée

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot.

  16. CVE-2026-76596 8.7 Élevée

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table

  17. CVE-2026-76571 9.3 Critique

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database.

  18. CVE-2026-67282 10.0 Critique

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unauthenticated attacker could execute arbitrary code by using the frontend listfilter model.

  19. CVE-2026-66915 10.0 Critique

    fabrikar.com Fabrik extension for Joomla

    Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the calc plugin.