Skip to main content

Fabrik EUVDEUVD-2026-64329

| CVE-2026-76602 CRITICAL
SQL Injection (CWE-89)
2026-08-22 Joomla GHSA-pcxq-w35v-gcxv
SQLi Fabrik Extension For Joomla
9.3
CVSS 4.0 · Vendor: Joomla
Share

Severity by source

Vendor (Joomla) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Unauthenticated network ORDER BY SQLi with low complexity gives PR:N/AC:L/AV:N; description limits it to read vectors, so C:H but I:N and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 22, 2026 - 15:10 vuln.today
CVE Published
Aug 22, 2026 - 14:21 cve.org
CRITICAL 9.3

DescriptionCVE.org

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.3 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors.

AnalysisAI

Unauthenticated SQL injection in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2, fixed in 4.7.3) lets remote attackers inject SQL through the 'order' parameter of list models, which is passed into ORDER BY clauses without validation. Because the vector is exposed without authentication over the network, any anonymous visitor to a Fabrik-powered list can extract database contents. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Locate public Fabrik list endpoint
Delivery
Craft malicious order parameter
Exploit
Inject SQL into ORDER BY clause
Execution
Execute blind extraction queries
Impact
Exfiltrate database contents
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target must expose a Fabrik list view (list model) that is reachable by the attacker and that accepts the 'order' sort parameter - this is the default behavior of Fabrik lists, so no unusual configuration is required. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals are strong on exposure but nuanced on impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker browses to a public Fabrik list page, then submits a crafted 'order' parameter containing a SQL subquery or boolean/time-based payload instead of a valid sort column. The application concatenates it into the ORDER BY clause and executes it, letting the attacker iteratively extract Joomla user records, session data, or other database contents. …
Remediation Upgrade the Fabrik extension to version 4.7.3 or later, which contains the fix (Vendor-released patch: 4.7.3); consult https://www.fabrikar.com/ for the release and installation guidance. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Begin immediately by identifying all Joomla installations with Fabrik extension versions 4.7.2 or earlier, prioritizing internet-facing systems. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Fabrik Extension For Joomla

View all
CVE-2026-67282 CRITICAL
10.0 Aug 12

Remote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthe
CVE-2026-66915 CRITICAL
10.0 Aug 10

Remote code execution in the Fabrik application-builder extension for Joomla (versions before 4.6.7) allows unauthentica
CVE-2026-76605 CRITICAL
10.0 Aug 22

Remote code execution in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.2) lets remote

CVE-2026-76604 CRITICAL
10.0 Aug 22

Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attac
CVE-2026-76606 CRITICAL
10.0 Aug 22

Path traversal in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through 4.7.2, fixed in 4
CVE-2026-76607 CRITICAL
10.0 Aug 22

Broken access control in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through releases p
CVE-2026-77992 CRITICAL
9.5 Aug 22

Remote code execution in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows attackers to break out of
CVE-2026-76571 CRITICAL
9.3 Aug 22

Unauthenticated SQL injection in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.3, fixe
CVE-2026-76598 HIGH
8.7 Aug 22

Unauthenticated remote attackers can invoke the onAjax_getFolders AJAX method in the Fabrik Extension for Joomla to enum
CVE-2026-76597 HIGH
8.7 Aug 22

Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) version
CVE-2026-76596 HIGH
8.7 Aug 22

Unauthenticated table truncation in the Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) allows any remote att
CVE-2026-76599 HIGH
8.7 Aug 22

Unauthenticated database schema disclosure in Fabrik for Joomla (versions 1.0.0-4.7.1) exposes arbitrary table names, co

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

EUVD-2026-64329 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy