CVE-2025-22212: Convert Forms Project Convert Forms

Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days.

A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the submission management area in backend.

Affected products

• Convert Forms Project Convert Forms: from 1.0.0, before 4.4.9 (fixed in 4.4.9)

Published 2025-03-05. Last modified 2026-06-17.