iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-12057 | The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing… | 9.8 | <1% | ||
| CVE-2025-12352 | The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all… | 9.8 | 1% | ||
| CVE-2025-32432 | Code Injection Enables Remote Code Execution in Craft CMS | 10.0 | 100% | KEVPoC ×4 | KEV |
| CVE-2025-6389 | Unauthenticated Remote Code Execution in Sneeit Framework WordPress Plugin | 9.8 | 76% | ||
| CVE-2025-7852 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via… | 9.8 | 2% | ||
| CVE-2026-0740 | Unauthenticated Arbitrary File Upload RCE in Ninja Forms File Uploads WordPress Plugin | 9.8 | 63% | ||
| CVE-2026-29014 | Unauthenticated PHP Code Injection RCE in MetInfo CMS | 9.3 | 39% | PoC ×2 | |
| CVE-2026-3395 | A flaw has been found in MaxSite CMS up to 109.1 | 5.5 | 4% | ||
| CVE-2026-3844 | Unauthenticated Arbitrary File Upload in Breeze Cache WordPress Plugin | 9.8 | 28% | ||
| CVE-2026-48907 | Unauthenticated PHP Code Upload and Execution in Joomla Content Editor (JCE) | 10.0 | 85% | KEVPoC ×4 | KEV |
| CVE-2026-48939 | Unauthenticated File-Upload RCE in Joomlic iCagenda for Joomla | 10.0 | 20% | KEVPoC | KEV |
| CVE-2026-56291 | Unauthenticated File Upload RCE in Balbooa Forms (Joomla) | 10.0 | 15% | KEVPoC | KEV |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Jul 13, 2026 Vulnerability / Web Security The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities ( KEV ) catalog, following reports of zero-day exploitation in the wild.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.