CVE-2026-48908

CVE-2026-48908 — SP Page Builder Joomla 未认证远程代码执行 针对 CVE-2026-48908 的概念验证漏洞利用程序，这是一个严重（CVSS 4.0 = 10.0 ）的未经认证的远程代码执行漏洞，存在于 JoomShaper 开发的 Joomla SP Page Builder 组件 comsppagebuilder 中。 | ---|--- CVE| CVE-2026-48908 弱点| CWE-284 不正确的访问控制 → 未经认证的任意文件上传 → RCE 组件| SP Page Builder comsppagebuilder for...

CVE-2026-48908-SP-Page-Builder-Joomla

CVE-2026-48908: SP Page Builder Joomla 未授权远程代码执行 CVE-2026-48908 漏洞的利用验证（PoC）代码，针对 Joomla SP Page Builder 组件的未授权远程代码执行漏洞。 漏洞概述 CVE-2026-48908 是一个严重安全漏洞，允许未授权的攻击者在易受攻击的 Joomla 安装上通过 SP Page Builder 组件对 ZIP 文件提取的处理不当来执行任意代码。 技术细节 CVE ID： CVE-2026-48908 组件： comsppagebuilder 受影响版本： = 6.6.1 修复版本： 6.6.2...

CVE-2026-48908-by-yora

🔐 CVE-2026-48908 Scanner & Safe PoC Joomla SP Page Builder — Unauthenticated File Upload / Potential RCE Developed byyora 📌 About This project is a security research and vulnerability detection tool developed by yora to help identify CVE-2026-48908 affecting SP Page Builder for Joomla. The...

CVE-2026-48908-Joomla-SP-Page-Builder-RCE

🛡️ Análisis de CVE-2026-48908 Carga Arbitraria de Archivos No Autenticada que deriva en RCE en JoomShaper SP Page Builder -critical?style=for-the-badge&logo=alert -black?style=for-the-badge&logo=github Un desglose técnico integral de una vulnerabilidad de ejecución remota de código no autenticada...

CVE-2026-48908-joomla-sp-page-builder-detection

CVE-2026-48908 — Validación y Detección de SP Page Builder para Joomla Validación de laboratorio de CVE-2026-48908 en el componente SP Page Builder de Joomla, centrada en evidencia técnica, reconstrucción de eventos y oportunidades de detección defensiva. El repositorio documenta una prueba...

CVE-2026-48908

CVE-2026-48908 — SP Page Builder Joomla 未认证远程代码执行漏洞利用 严重 CVSS v4: 10.0 — 针对 Joomla 的 SP Page Builder comsppagebuilder 中未认证远程代码执行的 PoC 漏洞利用 📋 漏洞概述 属性| 值 ---|--- CVE ID| CVE-2026-48908 严重性| 严重 CVSS v4 评分| 10.0 弱点| CWE-284 不当访问控制 → 未认证文件上传 组件| Joomla 的 SP Page Builder comsppagebuilder 受影响版本| 1.0.0 –...

CVE-2026-48908

🚨 CVE-2026-48908 — 通过任意文件上传实现完全服务器入侵 严重未认证文件上传 → 远程代码执行 RCE SP Page Builder 中的一个严重漏洞允许未认证攻击者上传任意文件并实现远程代码执行 RCE ，可能导致完全服务器入侵。 📖 概述 CVE-2026-48908 是一个影响 SP Page Builder （Joomla 的流行扩展）的严重安全漏洞。 该缺陷源于文件上传功能中的不恰当的访问控制和不足的验证，使攻击者能够在无需认证的情况下上传恶意文件。 成功利用可能导致： 远程代码执行 RCE 完全网站接管 数据库入侵 凭证窃取 持久后门安装 🎯 漏洞信息...

CVE-2026-48908-PoC

CVE-2026-48908 — SP Page Builder（Joomla）未认证RCE 针对CVE-2026-48908 的概念验证利用代码，这是一个严重的（CVSS 4.0 = 10.0 ）未认证远程代码执行漏洞，存在于JoomShaper开发的SP Page Builder 组件（comsppagebuilder）中，适用于Joomla。 | ---|--- CVE| CVE-2026-48908 弱点| CWE-284 访问控制不当 → 未认证的任意文件上传 → RCE 组件| SP Page Builder（comsppagebuilder）for Joomla 受影响版本...

CVE-2026-48908

CVE-2026-48908 — SP Page Builder 未认证远程代码执行 SP Page Builder comsppagebuilder for Joomla ≤ 6.6.1 允许未认证的攻击者上传任意文件并实现远程代码执行。 字段| 值 ---|--- CVE| CVE-2026-48908 CWE| CWE-284 访问控制不当 组件| SP Page Builder comsppagebuilder 受影响版本| 1.0.0 – 6.6.1 修复版本| 6.6.2 所需权限| 无（预认证） 用户交互| 无 FOFA 查询 root@kitploit:...

CVE-2026-67286

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name...

CVE-2026-67287

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input...

CVE-2026-67285

Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system...

EUVD-2026-57217

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input...

CVE-2026-67287

The CVE concerns the Joomla extension by JoomShaper: SP Page Builder versions below 6.8.0 are affected. An unauthenticated attacker can create comments on instances where guest commenting is disabled by overriding the relevant setting with user-supplied input. The description does not state speci...

CVE-2026-67287 Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input...

CVE-2026-67287

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input...

CVE-2026-67287 Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input...

CVE-2026-67286

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name...

CVE-2026-67286 Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name...

CVE-2026-67286 Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name...