Skip to content
Threat Feed
Subscribe

Product

Joomla < 5.2.2

1 brief RSS
high advisory

JoomShaper SP LMS PHP Object Injection Leads to RCE (CVE-2026-48909)

A critical PHP object injection vulnerability (CVE-2026-48909) in JoomShaper SP LMS versions <= 4.1.3 allows unauthenticated attackers to achieve remote code execution (RCE) via a crafted 'lmsOrders' cookie, leading to webshell deployment on vulnerable Joomla installations (< 5.2.2).

JoomShaper SP LMS <= 4.1.3 +1 webapps php object-injection rce webshell
1r 3t 1c