CVE-2026-65883

CVE-2026-65883 — Aimy Captcha-Less Form Guard = 20.0 clfgd Field → XOR Recovery → unserialize → FormattedtextLogger → RCE Overview Unauthenticated PHP Object Injection in Aimy Captcha-Less Form Guard for Joomla. The onCheckAnswer method base64-decodes the attacker-controlled clfgd POST field, run...

CVE-2026-65883 Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution...