CVE-2026-77027 is a high severity stored cross-site scripting (XSS) vulnerability in the Fabrik extension for Joomla, versions up to 4.7.1. It arises from improper handling of user-supplied input in the jsactions feature, allowing unauthenticated attackers to inject malicious scripts that are stored and later executed in users' browsers.
An unauthenticated SQL injection vulnerability exists in the Fabrik extension for Joomla versions up to 4.7.3. The issue arises because the 'order' parameter in list models is used in SQL queries without proper validation, allowing attackers to inject SQL commands. This vulnerability is identified as CWE-89 and has a critical CVSS 4.0 score of 9.3.
CVE-2026-76603 is a medium severity vulnerability in the Fabrik extension for Joomla versions 1.0.0 through 4.7.1. It involves improper access control in the form.inlineedit controller, which does not perform access checks and allows unauthenticated users to disclose rows (items) they should not access.
An unauthenticated SQL injection vulnerability exists in the Fabrik extension for Joomla versions up to 4.7.3. The flaw occurs because the condition parameter passed to a list filter is directly concatenated into an SQL WHERE clause without proper neutralization. This allows an attacker to inject arbitrary SQL commands, potentially exposing the full database contents. The vulnerability has a critical severity with a CVSS 4.0 base score of 9.3. No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-76597 is a high severity vulnerability in the Fabrik extension for Joomla versions up to 4.7.1. It allows unauthenticated attackers to upload arbitrary non-executable files to the web root via the list email plugin controller. This improper access control issue could lead to unauthorized file uploads, potentially impacting the affected web server environment.
An improper access control vulnerability exists in the Fabrik extension for Joomla versions up to 4.7.1. The onAjax_getFolders method allows unauthenticated users to perform arbitrary directory listings. This vulnerability is identified as CWE-284 and CWE-22 and has a high severity with a CVSS 4.0 score of 8.7.
A critical remote code execution vulnerability (CWE-94) exists in the Fabrik extension for Joomla versions 1.0.0 through 4.7.1. The flaw allows an attacker to execute arbitrary code via the image element. This vulnerability has a CVSS 4.0 base score of 10, indicating maximum severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-76596 is a high-severity vulnerability in the Fabrik extension for Joomla versions up to 4.7.1. It allows unauthenticated attackers to truncate database tables via the list.doempty endpoint due to missing access control checks. This can result in significant data loss without requiring any privileges or user interaction.
CVE-2026-77992 is a critical code injection vulnerability in the Fabrik extension for Joomla versions 1.0.0 through 4.7.1. The flaw involves a heredoc terminator breakout in the calc element and the onUpdateComment endpoint lacking access checks, allowing improper control of code generation.
CVE-2026-76600 is a medium severity vulnerability in the Fabrik extension for Joomla versions 1.0.0 through 4.7.1. It allows unauthenticated users to delete any comment via the DeleteComment endpoint due to lack of access control checks.
CVE-2026-76604 is a critical vulnerability in the Fabrik extension for Joomla, versions up to 4.7.3. It allows unauthenticated remote code execution via a PHP form element that improperly executes user-provided code. This vulnerability is classified as CWE-94, indicating improper control of code generation (code injection).
A critical improper access control vulnerability (CWE-284) exists in the Fabrik extension for Joomla versions up to 4.7.3. The issue is due to a missing ACL check in the download element, allowing unauthorized access. This vulnerability has a CVSS 4.0 base score of 10. No official patch or remediation guidance has been provided yet.
A vulnerability in the Fabrik extension for Joomla versions 1.0.0 through 4.7.1 allows unauthenticated attackers to modify any comment via the onUpdateComment endpoint due to missing access control checks.
A vulnerability in the Fabrik extension for Joomla versions 1.0.0 through 4.7.1 allows unauthenticated attackers to disclose any commenter's email address. This occurs because the onGetEmail endpoint does not perform access control checks. The issue is classified as improper access control (CWE-284) and has a medium severity with a CVSS score of 6.9.
CVE-2026-76599 is a high-severity vulnerability in the Fabrik extension for Joomla versions up to 4.7.1. It allows unauthenticated attackers to list arbitrary database tables and their prefixes via the ajax_tables method in the elements model. This improper access control issue can expose sensitive database structure information without requiring authentication.
An improper access control vulnerability (CWE-284) exists in the Fabrik extension for Joomla versions 1.0.0 through 4.7.1. The order plugin in these versions does not perform access checks on unauthenticated row reordering requests, allowing unauthorized users to reorder rows. This vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity.
Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting (XSS) through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla's Input::getArray() combined with PHP's variables_order=EGPCS (Cookie overrides POST in $_REQUEST ) to store unsanitized HTML in fields such as billing_first_name.
Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.
Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals.
Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's order_id to copy their cart contents and address data into the attacker's session. The CSRF token was validated but ownership was not checked.