Two Joomla Add-Ons, One Familiar Trap: When an Upload Feature Becomes a Remote Shell

CISA’s KEV listing for iCagenda and Balbooa Forms underscores a hard lesson for site operators: third-party extensions can turn a routine form or attachment feature into a code-execution path.