CVE-2026-76571
CriticalCVSS 9.3Summary
The Joomla extension Fabrik before version 4.7.3 contains an unauthenticated SQL injection vulnerability in the list filter condition parameter. The condition parameter is concatenated verbatim into the WHERE clause built by getFilterQuery(), allowing full read of the database.
Risk Assessment
An attacker can read the entire database, including credentials and sensitive information, posing a critical security risk.
Recommendation
Update Fabrik to version 4.7.3 or later to fix the vulnerability.
Original NVD description (English source)
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.3 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database.