Skip to content
Threat Feed
Subscribe

Vendor

Balbooa

4 briefs RSS
critical advisory

Critical RCE in Balbooa Forms via Shortcode Injection

CVE-2026-102425 is a critical unauthenticated remote code execution vulnerability in the Joomla Balbooa Forms extension allowing code injection via unsanitized field shortcodes.

Balbooa Forms remote-code-execution cve-2026-102425 joomla web-application
1r 2t 1c
critical threat

iCagenda Unrestricted File Upload Vulnerability Leading to RCE (CVE-2026-48939)

Attackers are actively exploiting CVE-2026-48939, an unrestricted file upload vulnerability in iCagenda, to upload malicious PHP code and achieve remote code execution on affected web servers.

exploited PoC iCagenda +19 web-application rce file-upload cve
1r 2t 5c 7i updated
critical threat

CVE-2026-56291: Balbooa Forms Unrestricted File Upload Vulnerability Leading to RCE

A critical unrestricted file upload vulnerability, CVE-2026-56291, in Balbooa Forms allows an unauthenticated attacker to upload executable files, potentially leading to arbitrary code execution on the server.

exploited Forms vulnerability web-vulnerability rce file-upload cisa-kev
1r 2t 1c
high advisory

CVE-2021-47930: Balbooa Joomla Forms Builder Unauthenticated SQL Injection

Balbooa Joomla Forms Builder version 2.0.6 is vulnerable to unauthenticated SQL injection via POST requests to the com_baforms component, allowing remote attackers to execute arbitrary SQL queries and extract sensitive database information by manipulating the 'id' parameter in a JSON payload.

Forms Builder 2.0.6 +1 sql-injection joomla cve-2021-47930 web-application
2r 1t 1c