RCE in Balbooa.com Balbooa Forms Component For Joomla

CVE-2026-65880

Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure form processing logic allowed code execution for forms that include the signature field type.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.005 (38.3th percentile) — read the EPSS interpretation.