CVE-2026-65880
Received Received - Intake

Unauthenticated Remote Code Execution in Balbooa Forms

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Joomla! Project

Description
Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure form processing logic allowed code execution for forms that include the signature field type.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-65880
EUVD
EUVD-2026-49751

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
balbooa balbooa_forms to 2.4.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated remote code execution flaw in the Balbooa Forms Joomla extension versions before 2.4.3. It occurs due to insecure form processing logic that allows code execution when a form includes a signature field type. Attackers can exploit this without needing to authenticate, potentially gaining full control over the affected system.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your server remotely without authentication. This could lead to complete system compromise, data theft, installation of malware, or disruption of services. If you use Balbooa Forms with a vulnerable version, your Joomla site and server are at high risk.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A successful exploit could result in data breaches, leading to legal penalties, fines, and reputational damage for organizations subject to these regulations.

Mitigation Strategies

Update Balbooa Forms to version 2.4.3 or later immediately to patch the insecure form processing logic that allows unauthenticated remote code execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65880. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart