CVE-2026-48909

🗓️ 20 Jun 2026 11:56:46Reported by JoomlaType

cve🔗 web.nvd.nist.gov👁 104 Views🌐 WEB

Joomla SP LMS extension deserializes user cookie data, enabling unauthenticated code execution.

Reporter	Title	Published	Views	Family All 10
GithubExploit	Exploit for CVE-2026-48909	21 Jun 202621:05	–	githubexploit
ATTACKERKB	CVE-2026-48909	20 Jun 202611:56	–	attackerkb
Circl	CVE-2026-48909	20 Jun 202613:49	–	circl
Cvelist	CVE-2026-48909 Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4	20 Jun 202611:56	–	cvelist
Exploit DB	Joomla Extension 4.1.4 - PHP Object injection	6 Jul 202600:00	–	exploitdb
EUVD	EUVD-2026-38108	20 Jun 202611:56	–	euvd
NVD	CVE-2026-48909	20 Jun 202613:16	–	nvd
Packet Storm	📄 Joomla JoomShaper SP LMS 4.1.3 PHP Object Injection	7 Jul 202600:00	–	packetstorm
Positive Technologies	PT-2026-51136	20 Jun 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-48909 Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4	20 Jun 202611:56	–	vulnrichment

[
  {
    "defaultStatus": "unaffected",
    "product": "SP LMS extension for Joomla",
    "vendor": "joomshaper.net",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.0-4.1.3"
      }
    ]
  }
]

Source	Link
joomshaper	www.joomshaper.com/

Parameter	Position	Path	Description	CWE
lmsOrders	header	/index.php?option=com_splms&view=cart	PHP unserialize of user-controlled cookie data (lmsOrders) enables PHP object injection leading to remote code execution in com_splms	CWE-502

23 Jun 2026 05:52Current

6.3Medium risk

Vulners AI Score6.3

CVSS 49.5

EPSS0.02726

SSVC

CWE-502