Fabrik Extension For Joomla
Monthly
Remote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthenticated attacker run arbitrary code on the server via the frontend listfilter model. The flaw is a CWE-94 code injection reachable over the network with no authentication or user interaction, and the vendor rates it maximum severity (CVSS 4.0 base 10.0). No public exploit code has been identified at the time of analysis, and it is not listed in CISA KEV, but the combination of unauthenticated access and full code execution makes it a top-priority patch.
Remote code execution in the Fabrik application-builder extension for Joomla (versions before 4.6.7) allows unauthenticated attackers to execute arbitrary code by abusing the ajax_calc endpoint of the bundled calc form plugin. The calc plugin evaluates user-influenced expressions server-side, and the AJAX handler exposes that evaluation without authentication, giving remote attackers full control of the underlying PHP process. CVSS 4.0 rates this 10.0 (maximum); no public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthenticated attacker run arbitrary code on the server via the frontend listfilter model. The flaw is a CWE-94 code injection reachable over the network with no authentication or user interaction, and the vendor rates it maximum severity (CVSS 4.0 base 10.0). No public exploit code has been identified at the time of analysis, and it is not listed in CISA KEV, but the combination of unauthenticated access and full code execution makes it a top-priority patch.
Remote code execution in the Fabrik application-builder extension for Joomla (versions before 4.6.7) allows unauthenticated attackers to execute arbitrary code by abusing the ajax_calc endpoint of the bundled calc form plugin. The calc plugin evaluates user-influenced expressions server-side, and the AJAX handler exposes that evaluation without authentication, giving remote attackers full control of the underlying PHP process. CVSS 4.0 rates this 10.0 (maximum); no public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.