fabrikar vulnerabilities

Products

• fabrik 2
• com fabrikar 1
• com_fabrik 1

Latest fabrikar CVEs

Newest publication first

1. CVE-2020-37219 Joomla com_fabrik 3.9.11 Directory Traversal via image.php

   Published 2026-05-13

   High·CVSS 8.7 EPSS 0.72%

   Joomla com_fabrik 3.9.11 contains a directory traversal vulnerability that allows unauthenticated attackers to list arbitrary files by manipulating the folder parameter. Attackers can send GET requests to the onAjax_files method with path traversal sequences to enumerate files in...

2. CVE-2018-10727 Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik_referrer hidden field in the Fabrikar Fabrik component through v3.8.1 for Joomla! allows remote attackers to inject arbitrary web scrip...

   Published 2019-10-29

   Medium·CVSS 6.1 EPSS 1.1%

   Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik_referrer hidden field in the Fabrikar Fabrik component through v3.8.1 for Joomla! allows remote attackers to inject arbitrary web script via the HTTP Referer header.

3. CVE-2011-5004 Unrestricted file upload vulnerability in models/importcsv.php in the Fabrik (com_fabrik) component before 2.1.1 for Joomla! allows remote authenticated users with Manager privileges to execute arbitr...

   Published 2011-12-25

   Medium·CVSS 6.0 EPSS 1.7%

   Unrestricted file upload vulnerability in models/importcsv.php in the Fabrik (com_fabrik) component before 2.1.1 for Joomla! allows remote authenticated users with Manager privileges to execute arbitrary code by uploading a file with an executable extension, then accessing it via...

4. CVE-2010-1981 Directory traversal vulnerability in the Fabrik (com_fabrik) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

   Published 2010-05-19

   Medium·CVSS 6.8 EPSS 12.0% Public exploit

   Directory traversal vulnerability in the Fabrik (com_fabrik) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.