EUVD Vulnerability Catalog
EUVD-2026-64327
Severity: CRITICAL
Base Score: 9.3
CVSS Version: 4.0
Vulnerability Description
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database.
CVSS Vector Analysis
Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
▪
Attack Vector (AV): Network
▪
Attack Complexity (AC): Low
▪
Attack Requirements (AT): None
▪
Privileges Required (PR): None
▪
User Interaction (UI): None
▪
Vulnerability Confidentiality Impact (VC): High
▪
Vulnerability Integrity Impact (VI): High
▪
Vulnerability Availability Impact (VA): High
▪
Subsequent Confidentiality Impact (SC): None
▪
Subsequent Integrity Impact (SI): None
▪
Subsequent Availability Impact (SA): None
Affected Vendors & Systems
Vendor
fabrikar.com
References & Advisory Links
Metadata Profile
Database Authority
European Union Agency for Cybersecurity (ENISA) EUVD
Assigner
Joomla
EPSS Probability
0
Known Aliases
GHSA-49rr-hfxh-8f4c
CVE-2026-76571
Published On
2026-08-22
Last Updated
2026-08-23