Vulnerabilidades de Fabrikar.com
CVEs publicadas que afetam produtos de Fabrikar.com: 17 registro(s), com severidade, exploração e correções.
CVE-2026-77992
Crítica · 9.5
CWE-94 22/08/2026
Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.
CVE-2026-77027
Alta · 8.6
CWE-79 22/08/2026
Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of user supplied input in the jsactions feature leads to an stored XSS vector.
CVE-2026-76609
Média · 6.9
CWE-284 22/08/2026
Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.
CVE-2026-76608
Média · 6.9
CWE-284 22/08/2026
Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any access checks.
CVE-2026-76607
Crítica · 10.0
CWE-284 22/08/2026
Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2.
CVE-2026-76606
Crítica · 10.0
CWE-22 22/08/2026
Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.
CVE-2026-76605
Crítica · 10.0
CWE-94 22/08/2026
Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2.
CVE-2026-76604
Crítica · 10.0
CWE-94 22/08/2026
Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 - The PHP form element is vulnerable to the execution of user provided codes.
CVE-2026-76603
Média · 6.9
CWE-284 22/08/2026
Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users.
CVE-2026-76602
Crítica · 9.3
CWE-89 22/08/2026
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors.
CVE-2026-76601
Média · 6.9
CWE-284 22/08/2026
Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks.
CVE-2026-76600
Média · 6.9
CWE-284 22/08/2026
Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks.
CVE-2026-76599
Alta · 8.7
CWE-284 22/08/2026
Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements model allows listings of arbitrary database tables including columns.
CVE-2026-76598
Alta · 8.7
CWE-22 22/08/2026
Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the elements model allows arbitrary directory listings.
CVE-2026-76597
Alta · 8.7
CWE-284 22/08/2026
Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot.
CVE-2026-76596
Alta · 8.7
CWE-284 22/08/2026
Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table
CVE-2026-76571
Crítica · 9.3
CWE-89 22/08/2026
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database.