CVE-2025-49485: Balbooa.com Balbooa Forms Component For Joomla

High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days.

A SQL injection vulnerability in the Balbooa Forms plugin 1.0.0-2.3.1.1 for Joomla allows privileged users to execute arbitrary SQL commands via the 'id' parameter.

Affected products

• Balbooa.com Balbooa Forms Component For Joomla: version 1.0.0-2.3.1.1 only

Published 2025-07-18. Last modified 2026-06-17.