CVE-2026-66915

Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.6.9 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the calc plugin.

Credits

Moe Khalilov, LeetProtect Research

References