JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write

JoomShaper Helix3 template framework versions 1.0 through 3.1.0 for Joomla expose an unauthenticated AJAX handler plgajaxhelix3 accessible via the Joomla comajax component. The onAjaxHelix3 plugin method processes dataaction=save requests without any authentication check or CSRF token validation...

CVE-2026-49049

CVE-2026-49049 취약점 분석: JoomShaper Helix3 Joomla의 인증되지 않은 임의 파일 쓰기 이 저장소는 CVE-2026-49049 심각도 취약점에 대한 자료, 기술 분석 및 PoCProof of Concept를 포함하고 있습니다. 이 취약점은 Joomla CMS용 JoomShaper의 구형 템플릿 프레임워크 Helix3버전 1.0 3.1.0에서 발견되었습니다. 이 취약점은 현재 자동화된 봇넷특히 AntonKill 디페이스 캠페인에 의해 실제 환경에서 적극적으로 악용되고 있습니다. 🔬 취약점 기술 분석...

CVE-2026-48908-Joomla-SP-Page-Builder-RCE

🛡️ CVE-2026-48908 분석 JoomShaper SP Page Builder의 인증되지 않은 임의 파일 업로드를 통한 RCE -critical?style=for-the-badge&logo=alert -black?style=for-the-badge&logo=github 인증되지 않은 원격 코드 실행 취약점에 대한 종합적인 기술 분석. 📌 핵심 요약 CVE-2026-48908 는 Joomla용 JoomShaper SP Page Builder 확장에서 발견된 치명적인 보안 취약점입니다. 이 취약점은 사용자 인증을 검증하거나...

CVE-2026-48908-PoC

CVE-2026-48908 — SP Page Builder Joomla 인증되지 않은 RCE CVE-2026-48908 에 대한 개념 증명 익스플로잇입니다. JoomShaper의 Joomla용 SP Page Builder 컴포넌트comsppagebuilder에서 발견된 심각한 CVSS 4.0 = 10.0 인증되지 않은 원격 코드 실행 취약점입니다. | ---|--- CVE| CVE-2026-48908 취약점 유형| CWE-284 부적절한 액세스 제어 → 인증되지 않은 임의 파일 업로드 → RCE 컴포넌트| Joomla용 SP...

Helix3-Mass-Exploiter

CVE-2026-49049 スキャナー & 自動書き込み JoomShaper Helix3 フレームワークに影響を与える CVE-2026-49049 脆弱性を特定し、テストするための専門的なセキュリティリサーチツールです。 教育目的のみ。 このプロジェクトは、許可されたセキュリティテストおよび脆弱性研究を目的としています。 概要 このツールは、CVE-2026-49049 の影響を受ける可能性のある Joomla インスタンスの特定を自動化します。脆弱な onAjaxHelix3 AJAX ハンドラーが公開されているかどうかを確認するために、非破壊的なチェックを実行します。 機能...

CVE-2026-81566

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The add-to-menu routine invoked the commenus item model's save method directly. That model does not perform authorisation itself, because the relevant checks reside in...

CVE-2026-78375 Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0

Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder Free and Pro 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave read jformattribssppagebuilderarticleid from the request and concatenated it directly into the WHERE viewid ...

CVE-2026-65879 Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms...

CVE-2026-65879

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms...

EUVD-2026-49197

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector...

CVE-2026-65878 Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1

Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager...

PT-2026-64912

Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector...

CVE-2026-65760

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system...

CVE-2026-65760 Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system...

CVE-2026-65760 Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system...

CVE-2026-65760

The CVE-2026-65760 entry concerns the Joomla Easy Store extension by joomshaper.com (versions 1.0.0–2.0.1). The vulnerability is described as improper access checks that allow logged-in users to retrieve order and customer information for any order, indicating a cross-customer confidentiality lea...

CVE-2026-57830 Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7

Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion...

CVE-2026-57829 Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated stored XSS...

CVE-2026-57829

The CVE concerns the Joomla extension Helix Ultimate (vulnerable component: the Helix Ultimate plugin) with an unauthenticated stored XSS in versions prior to 2.2.7. According to the shared metrics, the vulnerability has a CVSS 4.0 base score of 8.7 (HIGH) with network access, low attack complexi...

The vulnerability of the SP Page Builder component of the JoomShaper application software allows a hacker to execute arbitrary code.

The vulnerability of the SP Page Builder component of the JoomShape application software involves unlimited loading of dangerous files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...