Forms vulnerabilities
4 known vulnerabilities in Forms from Balbooa. 4 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 10.0 Critical severity
Balbooa Forms extension for Joomla: Improper Control of Generation of Code
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes ins
- 7.5 High severity
Balbooa Forms extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every objec
- 9.4 Critical severity
Balbooa Forms extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filenam
- 9.8 Critical severity
Balbooa Forms Unrestricted Upload of File with Dangerous Type Exploited
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.