Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload

Joomla Balbooa Forms contains an unrestricted file upload vulnerability caused by lack of authentication checks, letting unauthenticated attackers upload executable files and achieve remote code execution. id: CVE-2026-56291 info: name: Balbooa Forms 2.4.1 - Unauthenticated Arbitrary File Upload...

cve-2026-67363-67364

Balbooa Forms pre-auth RCE + Payment Tampering CVE-2026-67364 / CVE-2026-67363 PoC and detection templates for two pre-auth vulnerabilities in Balbooa Forms combaforms for Joomla, fixed in 2.4.3.2. CVE-2026-67364 — Pre-auth PHP Code Injection - RCE CVSS 9.8 CVE-2026-67363 — Pre-auth Payment Amoun...

CVE-2026-102425

CVE-2026-102425 — Balbooa Forms combaforms field shortcode → RCE Python 3 PoC for CVE-2026-102425 — balbooa.com Balbooa Forms Joomla extension — unauthenticated remote code execution via field shortcode injection in optional PHP-after-submission actions eval. | | | |---|---| | PoCbit |...

CVE-2026-102425

🖥️ BAForms-RCE — CVE-2026-102425 GUI Dark-neon GUI scanner/exploit untuk CVE-2026-102425 — Balbooa Forms combaforms 1.0.0–2.4.3.3: Unauthenticated RCE via field shortcode injection pada PHP-after-submission action eval. Implementasi GUI mandiri standalone — ditulis ulang dari nol berdasarkan...

CVE-2026-87930

🌐 Language / Dil 📌 Özet Joomla Multi-CVE Suite — 7 zafiyet modülü + x7-panel.php deploy CVE| Eklenti ---|--- CVE-2026-56291| Balbooa Forms combaforms CVE-2026-56290| Page Builder CK compagebuilderck CVE-2026-48908| SP Page Builder comsppagebuilder CVE-2026-48907| JCE comjce CVE-2026-48939| iCagen...

CVE-2026-56291

Auto Scanning Version & Exploit CVE-2026-56291 POC Joomla Unauthenticated Arbitrary File Upload leading to RCE in Balbooa Forms FOFA / Shodan FOFA: body="combaforms" Shodan: http.html:"baforms"...

CVE-2026-56291

CVE-2026-56291 — Balbooa Forms Joomla Mass RCE Exploit Pre-Auth form.uploadAttachmentFile → No CSRF → PHP Upload Overview CVE-2026-56291 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Balbooa Forms combaforms Joomla extension CISA KEV: Added July 10, 2026 — acti...

Exploit for Unrestricted Upload of File with Dangerous Type in Balbooa Forms

CVE-2026-56291 — Unauthenticated Arbitrary File Upload to RCE...

Exploit for CVE-2026-102425

🖥️ BAForms-RCE — CVE-2026-102425 GUI Dark-neon GUI scanner/...

Exploit for CVE-2026-102425

CVE-2026-102425 — Balbooa Forms combaforms field shortcode...

CVE-2026-102425

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling eval, the...

CVE-2026-102424

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose id merely looks numeric, the...

CVE-2026-101126

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming...

CVE-2026-101127

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in...

CVE-2026-101112

Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file. The controller verifies a Joomla session token, but the model does not bind that ...

CVE-2026-102424 Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose id merely looks numeric, the...

CVE-2026-102424 Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose id merely looks numeric, the...

EUVD-2026-89101

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose id merely looks numeric, the...

CVE-2026-102424

The Joomla Extension - balbooa.com component, specifically Balbooa Forms versions

CVE-2026-102425 Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling eval, the...