Balbooa Forms CVE-2026-65880

Q: What is the CVSS score of CVE-2026-65880?

CVE-2026-65880 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

Q: Which versions of Balbooa Forms are affected by CVE-2026-65880?

Remote code execution in Balbooa Forms prior to version 2.4.3 allows unauthenticated attackers to execute arbitrary PHP code on the Joomla server.

EUVD-2026-49751 CRITICAL

Code Injection (CWE-94)

2026-07-28 security@joomla.org

GHSA-82hc-qfgg-3mw6

RCE Code Injection

10.0

CVSS 4.0 · Vendor: joomla

Severity by source

Vendor (joomla) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (joomla) · only source for this CVE.

CVSS VectorVendor: joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 11:32 vuln.today

CVE Published

Jul 28, 2026 - 11:17 cve.org

CRITICAL 10.0

DescriptionCVE.org

Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure form processing logic allowed code execution for forms that include the signature field type.

AnalysisAI

Remote code execution in Balbooa Forms prior to version 2.4.3 allows unauthenticated attackers to execute arbitrary PHP code on the Joomla server. Exploitation requires forms that include the signature field type, where insecure processing logic can be triggered via a crafted submission. No public exploit or active exploitation has been identified at the time of analysis.