CVE-2026-76571CWE-89sql-injection

CVE-2026-76571

published August 22, 2026

CVSS
9.3
EPSS
0%
Percentile
35.2
In the wild
Unconfirmed
What it is

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00420 · 35.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-08-22T19:16Z
References (1)
https://www.fabrikar.com/ · [email protected]
EPSS history
Timeline
  • 22 AUG 14:21Z
    Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.3
    cvelistv5