https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 12:22:37 +0000 https://cve.radiocsirt.org/vuln/cve-2026-101127 <p><strong>Affected:</strong> balbooa.com Balbooa Forms extension for Joomla</p> <p>Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms &lt; 2.4.3.4 - The public form upload endpoint validates the uploaded file&#39;s extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in `#__baforms_submissions_attachments.name`. A later anonymous form submission associates that temporary attachment with the newly created submission. When an administrator opens the submission, the component&#39;s JavaScript retrieves the stored attachment record and concatenates `file.name` directly into an HTML string. The complete string is assigned to `innerHTML`.</p> <p><strong>Affected:</strong> balbooa.com Balbooa Forms extension for Joomla</p> <p>Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms &lt; 2.4.3.4 - The public form upload endpoint validates the uploaded file&#39;s extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in `#__baforms_submissions_attachments.name`. A later anonymous form submission associates that temporary attachment with the newly created submission. When an administrator opens the submission, the component&#39;s JavaScript retrieves the stored attachment record and concatenates `file.name` directly into an HTML string. The complete string is assigned to `innerHTML`.</p> https://cve.radiocsirt.org/vuln/cve-2026-101127