# balbooa.com Balbooa Forms extension for Joomla.

Every CVE that names balbooa.com Balbooa Forms extension for Joomla among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4](https://agentprime.io/advisories/CVE-2026-102424.md)
  `CVE-2026-102424` · CVE record: balbooa.com Balbooa Forms extension for Joomla · CVSS 8.9 High · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal
- [Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4](https://agentprime.io/advisories/CVE-2026-102425.md)
  `CVE-2026-102425` · CVE record: balbooa.com Balbooa Forms extension for Joomla · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Code injection
- [Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4](https://agentprime.io/advisories/CVE-2026-101126.md)
  `CVE-2026-101126` · CVE record: balbooa.com Balbooa Forms extension for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal
- [Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4](https://agentprime.io/advisories/CVE-2026-101112.md)
  `CVE-2026-101112` · CVE record: balbooa.com Balbooa Forms extension for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4](https://agentprime.io/advisories/CVE-2026-101127.md)
  `CVE-2026-101127` · CVE record: balbooa.com Balbooa Forms extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2](https://agentprime.io/advisories/CVE-2026-67364.md)
  `CVE-2026-67364` · CVE record: balbooa.com Balbooa Forms extension for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection
- [Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2](https://agentprime.io/advisories/CVE-2026-67363.md)
  `CVE-2026-67363` · CVE record: balbooa.com Balbooa Forms extension for Joomla · CVSS 7.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-472, CWE-602
- [Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1](https://agentprime.io/advisories/CVE-2026-56291.md)
  `CVE-2026-56291` · CVE record: balbooa.com balbooa.com Balbooa Forms extension for Joomla · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.15 · Not analysed yet · Published 9 Jul 2026 · Tags: Unrestricted file upload

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=balbooa-com-balbooa-forms-extension-for-joomla>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/balbooa-com-balbooa-forms-extension-for-joomla/>. Everything for agents: <https://agentprime.io/llms.txt>.