CVE Catalog
CVE-2026-66915
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk0.60%
46th percentile - higher than 46% of all known CVEs
Summary
The Joomla extension Fabrik before version 4.6.9 contains a remote code execution vulnerability. An unauthenticated attacker can execute arbitrary code by using the ajax_calc feature of the calc plugin.
Risk Assessment
An unauthenticated attacker can take over the server, leading to full compromise of the system and data.
Recommendation
Update the Fabrik extension to version 4.6.9 or later to remediate the vulnerability.
Original NVD description (English source)
Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.6.9 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the calc plugin.