Login Request a demo
FO
Product
Forms
by Balbooa · last CVE Sep 29, 2026
On CISA KEVExploited in the wild
6
CVEs
1
On KEV
10.0
Max CVSS
5
New 30D
Vulnerabilities6In the news2Timeline
Severity mix
Critical 3High 1Medium 2Low 0
Severity
All severities6Critical3High1Medium2Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Forms to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-56291
In wildKEV
9.8
15%
Jul 9
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
Affected: before 2.4.1
CVE-2026-102425
10.0
1%
Sep 29
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4
Affected: before 2.4.3.4
CVE-2026-101127
9.4
0%
Sep 29
Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4
Affected: before 2.4.3.4
CVE-2026-102424
7.5
0%
Sep 29
Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4
Affected: before 2.4.3.4
CVE-2026-101126
6.5
0%
Sep 29
Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4
Affected: before 2.4.3.4
CVE-2026-101112
5.3
0%
Sep 29
Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4
Affected: before 2.4.3.4
Showing 6