{"uuid": "9cd57845-0d5d-459d-a415-63b5abd1a8a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-67364", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117122415059936959", "content": "CVE-2026-67364 (CVSS 10): CRITICAL pre-auth PHP code injection in Balbooa Forms for Joomla (v1.0.0 \u2013 2.4.3.1). Exploitable via unescaped query param in custom-PHP handler. Update to 2.4.3.2+ now. https://radar.offseq.com/threat/cve-2026-67364-cwe-94-improper-control-of-generation-of-code-code-injection-in-balbooacom-balbooa-36f88c0efc17ca75 #OffSeq #Joomla #CVE202667364 #WebSecurity", "creation_timestamp": "2026-08-19T13:30:27.877489Z"}