CVE-2026-76602CWE-89sql-injection

CVE-2026-76602

published August 22, 2026

CVSS

9.3

EPSS

Percentile

31.4

In the wild

Unconfirmed

What it is

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors.

The record

Technical detail

CVSS: 9.3 · NONE
CVSS v4.0: 9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00386 · 31.4th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-08-22T19:16Z

References (1)

https://www.fabrikar.com/ · [email protected]

EPSS history

Timeline

22 AUG 14:21Z
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.3
cvelistv5