Balbooa Forms vulnerabilities
4 known CVE vulnerabilities in Balbooa Forms, translated and rated.
- CVE-2026-67364Critical
Critical vulnerability (CVSS 9.8) in Joomla extension Balbooa Forms versions prior to 2.4.3.2. Allows an unauthenticated attacker to inject and execute arbitrary PHP code on the server via a URL parameter in a shortcode, when the form has a custom PHP handler configured.
- CVE-2026-65880Critical
The Joomla extension Balbooa Forms versions below 2.4.3 are vulnerable to unauthenticated remote code execution. Insecure form processing logic allows code execution for forms that include the signature field type.
- CVE-2026-56291CriticalActively exploited
The Balbooa Forms extension for Joomla versions below 2.4.1 contains a vulnerability allowing an unauthenticated attacker to upload arbitrary files, including executable files. This leads to full remote code execution (RCE).
- CVE-2026-67363High
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured product prices. Neither endpoint enforces authentication or CSRF checks. An unauthenticated attacker can purchase any priced item for an arbitrary amount (e.g., $0.01), and can additionally forge line items, quantities, and shipping.