中文

// CVE · PUBLISHED 2026-08-22

CVE-2026-76602

fabrikar.com / Fabrik extension for Joomla

9.3 · CVSS 4.0Critical

Description

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors.

References

Related CVEs

  • CVE-2026-76607fabrikar.com / Fabrik extension for JoomlaCVSS 10.0
  • CVE-2026-76606fabrikar.com / Fabrik extension for JoomlaCVSS 10.0
  • CVE-2026-76605fabrikar.com / Fabrik extension for JoomlaCVSS 10.0
  • CVE-2026-76604fabrikar.com / Fabrik extension for JoomlaCVSS 10.0
  • CVE-2026-76571fabrikar.com / Fabrik extension for JoomlaCVSS 9.3
  • CVE-2026-77264101gen / Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country CodeCVSS 9.8
  • CVE-2026-77644PTC / Windchill Risk and Reliability Enterprise Edition (Formerly Relex)CVSS 9.3
  • CVE-2026-74001WPEverest / User Registration & Membership ProCVSS 9.8

← CVE Index: search every CVE from the last 30 days

This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.