Threats Tagged 'ghsa-r3hx-8v55-pg55'

CVE-2026-102425 is a critical remote code execution vulnerability in the Balbooa Forms extension for Joomla versions 1.0.0 through 2.4.3.3. The vulnerability arises from improper control of code generation (CWE-94) due to the way administrator-defined PHP code executes after public form submissions. Specifically, the extension replaces form-field shortcodes with user-submitted values inside a double-quoted PHP string before calling eval(), enabling attackers to inject and execute arbitrary PHP code. Exploitation requires the use of the optional PHP-after-submission feature with an attacker-controlled shortcode. The vulnerability has a CVSS 4.0 score of 9.5, indicating critical severity. No official patch or vendor advisory is provided in the data, and no known exploits in the wild have been reported.