CVE-2018-25380: Extro Extroforms

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Joomla Component eXtroForms 2.1.5 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL commands through the filter_type_id, filter_pid_id, and filter_search parameters. Attackers can submit POST requests to the extroformfield view with malicious SQL payloads to extract sensitive database information and server data.

Affected products

• Extro Extroforms: version 2.1.5 only

Published 2026-05-25. Last modified 2026-07-24.