# CVE-2021-47930: Balbooa Joomla Forms Builder SQL injection in form submission handler

Source: https://junglewise.ai/threats/cve-2021-47930-balbooa-joomla-forms-builder-sql-injection-in-form-submission  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-10. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2021-47930 · Severity: high · CVSS 8.2 · Published 2026-05-10

Balbooa Joomla Forms Builder is a popular extension used to create and manage custom forms on Joomla websites. A security flaw in how the software handles form submissions allows unauthorized individuals to access and extract sensitive information from the website's database. This could lead to the exposure of user data, administrative credentials, or other confidential business information stored on the server.

Vendors: [Balbooa](https://junglewise.ai/threats/vendors/balbooa).

## Quick answers

**Is CVE-2021-47930 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-47930 being exploited in the wild.

**How severe is CVE-2021-47930?** High severity, with a CVSS score of 8.2, published 10 May 2026.

**Which products and versions are affected?** Balbooa Forms Builder <= 2.0.6.

**Is there a fix for CVE-2021-47930?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2021-47930 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-47930?** Check whether you run Balbooa Forms Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unauthenticated SQL injection vulnerability exists in Balbooa Joomla Forms Builder version 2.0.6 and potentially earlier versions. The flaw is located within the form submission handler of the com_baforms component. Attackers can exploit this by sending a specially crafted POST request containing a malicious JSON payload in the 'id' field parameter. Because the input is not properly neutralized before being used in an SQL command (CWE-89), a remote, unauthenticated attacker can execute arbitrary SQL queries to extract sensitive data from the underlying database. Public exploit code is available for this vulnerability.

## Affected products

- Balbooa Joomla Forms Builder <= 2.0.6

## Timeline

- 2021-10-24: disclosed: Initial discovery and exploit publication by blockomat2100
- 2026-05-10: advisory: CVE-2021-47930 published by VulnCheck/NVD

## References

- [https://www.balbooa.com/](https://www.balbooa.com/)
- [https://www.exploit-db.com/exploits/50447](https://www.exploit-db.com/exploits/50447)
- [https://www.vulncheck.com/advisories/balbooa-joomla-forms-builder-sql-injection-unauthenticated](https://www.vulncheck.com/advisories/balbooa-joomla-forms-builder-sql-injection-unauthenticated)