Joomla JCE 2.9.99.4 Remote Code Execution

The JCE Joomla Content Editor profile import functionality lacks proper authentication and CSRF protections. An unauthenticated attacker can upload a crafted XML file containing PHP code; the file is stored in the /tmp/ directory and can be accessed via HTTP, leading to remote code execution...

📄 Joomla Content Editor 2.9.99.4 Shell Upload

This Metasploit module exploits an unauthenticated arbitrary profile creation vulnerability in the JCE Joomla Content Editor extension for Joomla!. The profiles.import task fails to enforce authentication, allowing the import of a crafted profile that is directly written to disk as a PHP web shel...

COM_JCE_VANDA

COMJCEVANDA - CVE-2026-48907 Exploit de upload de arquivo sem...

Exploit for Improper Access Control in Widgetfactorylimited Jce

Joomla JCE CVE-2026-48907 — PoC Validation, Webshell Artifacts...

Exploit for CVE-2026-48907

CVE-2026-48907 TODO - Init own cve ⚡ Simple Usage U...

Exploit for CVE-2026-48907

CVE-2026-48907 Educational PoC ⚠️ This repository is for ed...

CVE-2026-48907

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution...