PT-2025-25251 · Joomla · Rsform!Pro

Kamil Szczurowski + 1 · Published 2025-06-11 · Updated 2025-06-14 · CVE-2025-30085

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:L/U:Clear

Name of the Vulnerable Software and Affected Versions RSForm!pro versions 3.0.0 through 3.3.14

Description A remote code execution vulnerability was discovered in the RSForm!pro component for Joomla. The issue occurs within the submission export feature and requires administrative access to the export feature.

Recommendations For RSForm!pro versions 3.0.0 through 3.3.14, consider disabling the submission export feature until a patch is available. Restrict access to the export feature to minimize the risk of exploitation. Avoid using the export feature with administrative access until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-30085

Affected Products

Rsform!Pro

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-30085 · Security Note
• https://t.me/cvenotify/125442 · Telegram Post
• https://t.me/cvetracker/26051 · Telegram Post
• https://t.me/latest_high_impact_cve/2611 · Telegram Post
• https://twitter.com/SecAideInfo/status/1933830281821069784 · Twitter Post
• https://twitter.com/offseq/status/1932951012496617737 · Twitter Post
• https://twitter.com/threatsbank/status/1933132424784863384 · Twitter Post
• https://twitter.com/CveFindCom/status/1932885562521715053 · Twitter Post
• https://twitter.com/CVEnew/status/1932882532225421470 · Twitter Post
• https://rsjoomla.com · Note