Advisories · Technology
balbooa.com Balbooa Forms extension for Joomla.
Every CVE that names balbooa.com Balbooa Forms extension for Joomla among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.9 High
Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4
- balbooa.com Balbooa Forms extension for Joomla
- Path traversal
- CVSS 9.5 CriticalCritical · CVSS 9+
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4
- balbooa.com Balbooa Forms extension for Joomla
- Code injection
- CVSS 6.9 Medium
Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4
- balbooa.com Balbooa Forms extension for Joomla
- Path traversal
- CVSS 6.9 Medium
Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4
- balbooa.com Balbooa Forms extension for Joomla
- Broken access control
- CVSS 8.6 High
Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4
- balbooa.com Balbooa Forms extension for Joomla
- Cross-site scripting (XSS)
- CVSS 10.0 CriticalCritical · CVSS 9+
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2
- balbooa.com Balbooa Forms extension for Joomla
- Code injection
- CVSS 7.7 High
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2
- balbooa.com Balbooa Forms extension for Joomla
- CWE-472
- CWE-602
- CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
- balbooa.com Balbooa Forms extension for Joomla
- Unrestricted file upload