High severity · published Jul 18, 2025
CVE-2025-49485
Extension - balbooa.com - SQL injection in Balbooa Forms component version 1.0.0 - 2.3.1.1 for Joomla
8.6
CVSS
0.3%
EPSS
No
On KEV
Description
A SQL injection vulnerability in the Balbooa Forms plugin 1.0.0-2.3.1.1 for Joomla allows privileged users to execute arbitrary SQL commands via the 'id' parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Balbooa Forms component for Joomla · balbooa.com
1.0.0-2.3.1.1 · source: vendor
Affected product
BF
Balbooa Forms component for Joomla
balbooa.com
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-49485
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-49485
extensions.joomla.org
https://extensions.joomla.org/extension/forms/
More from Balbooa Forms component for Joomla
10.0
CVE-2026-65880
Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3