Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: Balbooa Component: Forms Clear all filters
TI-2026-65393 CVE-2026-102424 · GHSA-j3r3-fqf7-gc2r

Path traversal in Balbooa Forms extension for Joomla

Priority MEDIUM 45

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during…

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00373 Published 2026-09-29 No fix listed CWE-22
TI-2026-65394 CVE-2026-102425 · GHSA-r3hx-8v55-pg55

Code injection in Balbooa Forms extension for Joomla

Priority MEDIUM 50

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.00586 Published 2026-09-29 No fix listed CWE-94
TI-2026-65138 CVE-2026-101126 · GHSA-5w98-66mc-mjqc

Path traversal in Balbooa Forms extension for Joomla

Priority LOW 36

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00245 Published 2026-09-29 No fix listed CWE-22
TI-2026-65137 CVE-2026-101112 · GHSA-4rr9-73qg-q46x

Authorization bypass in Balbooa Forms extension for Joomla

Priority LOW 36

Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00214 Published 2026-09-29 No fix listed CWE-639
TI-2026-65139 CVE-2026-101127 · GHSA-r586-6h3h-vc7q

Cross-site scripting in Balbooa Forms extension for Joomla

Priority LOW 39

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the atta…

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.0033 Published 2026-09-29 No fix listed CWE-79
TI-2026-40656 CVE-2026-56291 · GHSA-28f5-j5p5-xmmw

Unrestricted file upload in balbooa.com Balbooa Forms extension for Joomla

Priority CRITICAL 100KEV

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executa…

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.14854 Published 2026-07-09 No fix listed CWE-434