CVE-2026-65883criticalCWE-502

CVE-2026-65883: critical vulnerability in aimy-extensions.com Aimy Captcha-Less Form…

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0

Published

Follow this CVE+ Monitor Aimy Captcha-Less Form Guard plugin for Joomla

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 10epss 0.8%
from disclosure to weapon1 day
Published on NVDJul 29
1st PoC+1d
Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
aimy-extensions.com · Aimy Captcha-Less Form Guard plugin for Joomla
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.