CVE Catalog
CVE-2026-65880
CriticalCVSS 10.0Summary
The Joomla extension Balbooa Forms versions below 2.4.3 are vulnerable to unauthenticated remote code execution. Insecure form processing logic allows code execution for forms that include the signature field type.
Risk Assessment
An attacker can remotely execute arbitrary code on the server without authentication, leading to full system compromise.
Recommendation
Immediately update the Balbooa Forms plugin to version 2.4.3 or later.
Original NVD description (English source)
Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure form processing logic allowed code execution for forms that include the signature field type.