CVE-2026-76571 - Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 · CoreCVE

Back Back to CVE browser

CRITICAL

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2

Published Aug 22, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 0.42%

Description

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database.

Affected products

Vendor Fabrikar.com Product Fabrik extension for Joomla Default
unaffected
- Version
  1.0.0-4.7.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Fabrik extension for Joomla

unaffected

Version	Status	Constraints
1.0.0-4.7.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64327
Advisory
https://www.fabrikar.com/
product

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64327		Advisory
https://www.fabrikar.com/		product

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Joomla

Published Aug 22, 2026

Updated Aug 25, 2026

Reserved Aug 19, 2026

Link CVE-2026-76571

CISA Vulnrichment

Updated Aug 24, 2026

Status Deferred

Modified Aug 26, 2026

Link CVE-2026-76571

Severity n/a

Public date n/a

Links CVE-2026-76571

Assigner Joomla

Published Aug 22, 2026

Updated Aug 25, 2026

Exploited since n/a

Link EUVD-2026-64327

EUVD-2026-64327