CVE-2026-65883CWE-502insecure-deserialization

CVE-2026-65883

Critical · published July 29, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
56.5
In the wild
Unconfirmed
What it is

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00812 · 56.5th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-07-29T15:16Z
Affected products (1)
ProductVersionsFixed in
aimy-extensions/aimy_captcha-less_form_guard≥ 18.0, ≤ 20.0—
References (1)
https://www.aimy-extensions.com/joomla/captcha-less-form-guard.html · [email protected]
EPSS history
Timeline
  • 29 JUL 09:34Z
    Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0
    cvelistv5