CVE-2026-48909

CVE-2026-48909 — SP LMS PHP Object Injection → RCE Unauthenticated Remote Code Execution via PHP Object Injection in JoomShaper SP LMS comsplms ≤ 4.1.3 for Joomla CMS. Author: Amin İsayev / Proxima Cyber Security Overview SP LMS is a popular Joomla Learning Management System extension by JoomShap...

CVE-2026-48909-Joomla-SP-Exploit

CVE-2026-48909 Joomla SP LMS — Inyección de Objetos PHP no Autenticada → Ejecución Remota de Código Herramienta de prueba de concepto para CVE-2026-48909 Autor: Sudeepa Wanigarathna !IMPORTANT Solo para uso autorizado. Esta herramienta está destinada a la investigación de seguridad, educación y...

Joomla Extension 4.1.4 - PHP Object injection

Exploit Ttile: Joomla Extension 4.1.4 - PHP Object injection Affected : JoomShaper SP LMS = 4.1.4 Author : Amin İsayev / Proxima Cyber Security Joomla version note: RCE requires Joomla = 5.2.2 patched FormattedtextLogger.wakeup which blocks the gadget chain — PHP Object Injection still exists in...

CVE-2026-48909 Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4

SP LMS comsplms 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server...

CVE-2026-48909 Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4

SP LMS comsplms 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server...