Balbooa Forms — known CVE vulnerabilities

Every CVE whose affected-product data names Balbooa Forms, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (6)

• CVE-2026-102425 — CVSS 10.0 (critical): Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports…
• CVE-2026-56291 — CVSS 9.8 (critical) — actively exploited: Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is…
• CVE-2026-101127 — CVSS 9.4 (critical): Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint…
• CVE-2026-102424 — CVSS 7.5 (high): Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms <…
• CVE-2026-101126 — CVSS 6.5 (medium): Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per…
• CVE-2026-101112 — CVSS 5.3 (medium): Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action…