CVE Catalog
CVE-2026-76602
CriticalCVSS 9.3Summary
The Joomla extension Fabrik before version 4.7.3 contains an unauthenticated SQL injection vulnerability in the ORDER BY clause. The order parameter in list models is used in queries without validation, allowing read SQLi vectors.
Risk Assessment
An attacker can exploit the vulnerability to read sensitive data from the database, compromising information confidentiality.
Recommendation
Update Fabrik to version 4.7.3 or later to fix the vulnerability.
Original NVD description (English source)
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.3 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors.