CRITICAL 9.3 NVD

CVE-2026-76571

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.3 - The condition parameter passed to a list

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.3 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database.

References

https://www.fabrikar.com/

Published: 2026-08-22 · Source: NVD · Feed updated: 2026-08-22

This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-08-22 via NVD.

Risk Timeline

CVE Disclosed2026-08-22 · -1 days ago

Remediation Resources

Analysis & PoC

www.fabrikar.com/

vulnfeed aggregates 11022 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.