Skip to content
Threat Feed
Subscribe

Vendor

Joomshaper

3 briefs RSS
critical threat

CVE-2026-48908 - JoomShaper SP Page Builder Unrestricted File Upload leading to RCE

A critical unrestricted file upload vulnerability, CVE-2026-48908, in JoomShaper SP Page Builder allows unauthenticated attackers to upload arbitrary files of dangerous types, specifically PHP code, which can be executed on the server to achieve remote code execution and full system compromise.

SP Page Builder +1 web-exploit cve rce php cisa-kev
2r 3t 1i updated
high advisory

JoomShaper SP LMS PHP Object Injection Leads to RCE (CVE-2026-48909)

A critical PHP object injection vulnerability (CVE-2026-48909) in JoomShaper SP LMS versions <= 4.1.3 allows unauthenticated attackers to achieve remote code execution (RCE) via a crafted 'lmsOrders' cookie, leading to webshell deployment on vulnerable Joomla installations (< 5.2.2).

JoomShaper SP LMS <= 4.1.3 +1 webapps php object-injection rce webshell
1r 3t 1c
high advisory

Joomla SP Movie Database Unauthenticated SQL Injection (CVE-2017-20266)

An SQL injection vulnerability, CVE-2017-20266, in Joomla SP Movie Database version 1.3 allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the `searchword` parameter in GET requests to the `searchresults` view, enabling extraction of sensitive database information.

SP Movie Database 1.3 sqli web-application joomla cve
2r 3t 1c