← CVE Intelligence

CVE-2026-76571

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 PUBLISHED

Description (CNA)

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database.

Affected (CNA)

Vendor / productVersions
fabrikar.com / Fabrik extension for Joomlaaffected 1.0.0-4.7.1

CWE

CWE-89

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.