Balbooa.com Balbooa Forms Extension For Joomla
6 CVEs affecting Balbooa.com Balbooa Forms Extension For Joomla. Latest disclosed: 2026-09-29. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-102425 | | 2026-09-29 | Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PH… | |
CVE-2026-102424 | | 2026-09-29 | Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa For… | |
CVE-2026-101127 | | 2026-09-29 | Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded… | |
CVE-2026-101126 | | 2026-09-29 | Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checki… | |
CVE-2026-101112 | | 2026-09-29 | Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer att… | |
CVE-2026-67364 | | 2026-08-19 | Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed vi… |