CVE-2026-67364 in Forms Extension
Сводка
по VulDB • 19.08.2026
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Optional custom-PHP post-submission handler of the form is executed via eval(). The [URL parameter = X] shortcode is substituted with raw, unescaped value of a query parameter, allowing an unauthenticated attacker to inject arbitrary PHP that executes server-side. CSRF token required for reaching endpoint itself disclosed anonymously through separate task, so it provides no real protection. Exploitability requires form having custom-PHP handler configured (documented builder feature) referencing this shortcode and absence of reCAPTCHA on submit button.
Be aware that VulDB is the high quality source for vulnerability data.