CVE Catalog
CVE-2026-65883
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk0.50%
40th percentile - higher than 40% of all known CVEs
Summary
Joomla Extension Aimy Captcha-Less Form Guard 18.0-20.0 is vulnerable to PHP object injection via a forged clfgd field, leading to remote code execution.
Risk Assessment
An unauthenticated attacker can take over the Joomla server.
Recommendation
Immediately update the extension to a version outside 18.0-20.0 or apply the available patch.
Original NVD description (English source)
Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution.