CVE Vulnerability Advisory Database

[Affected Scope] Joomla Balbooa Forms extension versions prior to 2.4.1

[Impact] Unauthenticated attackers can upload arbitrary executable files (such as PHP), leading to full Remote Code Execution (RCE) and complete compromise of the web server

[Mitigation] Immediately upgrade the Balbooa Forms extension to version 2.4.1 or higher, and disable script execution in upload directories

[Affected Scope] Joomla iCagenda extension versions prior to 3.9.15 and 4.0.8

[Impact] Unauthenticated remote attackers can bypass file upload restrictions to upload malicious PHP scripts, leading to complete system compromise via Remote Code Execution (RCE).

[Mitigation] Immediately upgrade the iCagenda extension to the patched versions (3.9.15 / 4.0.8 or higher) and disable script execution in upload directories.

[Affected Scope] Websites utilizing the SP Page Builder extension for Joomla

[Impact] Unauthenticated attackers can upload and execute malicious PHP code, leading to complete takeover of the web server

[Mitigation] Immediately update to the latest patched version, apply WAF rules, and disable PHP execution in upload directories

[Affected Scope] Vulnerable versions of the JCE (Joomla Content Editor) extension for Joomla CMS

[Impact] Unauthenticated remote attackers can create unauthorized editor profiles, bypass file upload restrictions, and upload malicious PHP scripts to achieve full Remote Code Execution (RCE)

[Mitigation] Immediately upgrade JCE to the latest patched version and deploy Web Application Firewall (WAF) rules to block unauthorized profile modification requests

[Affected Scope] Joomla! versions 4.0.0 through 4.2.7

[Impact] Unauthenticated remote attackers can bypass access controls to access sensitive API endpoints, exposing database credentials and system configuration details

[Mitigation] Immediately upgrade Joomla! to the patched version (4.2.8 or higher) and rotate all database credentials