Fabrikar
Fabrikar Fabrik: vulnerabilidades y CVE
Fabrikar Fabrik tiene 21 vulnerabilidades publicadas, 19 de ellas en los últimos 12 meses. 9 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE21
Últimos 12 meses19
Críticas9
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-77992 | Crítica (9.5) | 0.44% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks. |
| CVE-2026-77027 | Alta (8.6) | 0.44% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of user supplied input in the jsactions feature leads to an stored XSS vector. |
| CVE-2026-76609 | Media (6.9) | 0.41% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks. |
| CVE-2026-76608 | Media (6.9) | 0.41% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any access checks. |
| CVE-2026-76607 | Crítica (10) | 0.41% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2. |
| CVE-2026-76606 | Crítica (10) | 0.50% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2. |
| CVE-2026-76605 | Crítica (10) | 0.70% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2. |
| CVE-2026-76604 | Crítica (10) | 0.70% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 - The PHP form element is vulnerable to the execution of user provided codes. |
| CVE-2026-76603 | Media (6.9) | 0.41% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users. |
| CVE-2026-76602 | Crítica (9.3) | 0.39% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors. |
| CVE-2026-76601 | Media (6.9) | 0.41% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks. |
| CVE-2026-76600 | Media (6.9) | 0.41% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks. |
| CVE-2026-76599 | Alta (8.7) | 0.41% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements model allows listings of arbitrary database tables including… |
| CVE-2026-76598 | Alta (8.7) | 0.46% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the elements model allows arbitrary directory listings. |
| CVE-2026-76597 | Alta (8.7) | 0.44% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot. |
| CVE-2026-76596 | Alta (8.7) | 0.41% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table |
| CVE-2026-76571 | Crítica (9.3) | 0.42% | — | 22 ago 2026 | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built… |
| CVE-2026-67282 | Crítica (10) | 0.78% | — | 12 ago 2026 | Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unauthenticated attacker could execute arbitrary code by using the frontend listfilter model. |
| CVE-2026-66915 | Crítica (10) | 0.82% | — | 10 ago 2026 | Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the calc plugin. |
| CVE-2018-10727 | Media (6.1) | 1.0% | — | 29 oct 2019 | Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik_referrer hidden field in the Fabrikar Fabrik component through v3.8.1 for Joomla! allows remote attackers to inject arbitrary web script via the HTTP… |
| CVE-2010-1981 | Media (6.8) | 12% | — | 19 may 2010 | Directory traversal vulnerability in the Fabrik (com_fabrik) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.