{"metadata": {"vulnerability": "cve-2026-48909", "count": 31, "kinds": {"milestone": 4, "sighting": 19, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-05-26T10:06:17.657Z", "date_only": false, "value": "2026-05-26T10:06:17.657Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-48909", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-20T11:56:46.771Z", "date_only": false, "value": "2026-06-20T11:56:46.771Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-48909", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-20T13:16:42Z", "date_only": false, "value": "2026-06-20T13:16:42Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-GF8C-XMWJ-WHRH", "record": "GHSA-GF8C-XMWJ-WHRH", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-06-20T13:16:42.317Z", "date_only": false, "value": "2026-06-20T13:16:42.317", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48909", "record": "FKIE_CVE-2026-48909", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-20T13:49:58.589Z", "date_only": false, "value": "2026-06-20T13:49:58.589839Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mopyrpawac2a", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "661b8d17-cdc3-46c3-a12c-d35f47af3463", "content": "CVE-2026-48909 - Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla\nCVE ID : CVE-2026-48909\n \n Published : June 20, 2026, 11:56 a.m. | 1\u00a0hour, 13\u00a0minutes ago\n \n Description : SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-con...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mopyrpawac2a"}, {"timestamp": "2026-06-20T15:32:23Z", "date_only": false, "value": "2026-06-20T15:32:23Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-GF8C-XMWJ-WHRH", "record": "GHSA-GF8C-XMWJ-WHRH", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-20T15:32:23Z", "date_only": false, "value": "2026-06-20T15:32:23Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-GF8C-XMWJ-WHRH", "record": "GHSA-GF8C-XMWJ-WHRH", "field": "modified"}, {"timestamp": "2026-06-21T03:00:27.502Z", "date_only": false, "value": "2026-06-21T03:00:27.502416Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3morex5l44o2t", "record": "cve-2026-48909", "field": "creation_timestamp", "uuid": "8b3d1c5d-ab83-45ab-9594-ab6b6f23c11c", "content": "Critical deserialization issue in JoomShaper SP LMS (Joomla, v1.0.0 \u2013 4.1.3): Unauthenticated RCE possible. No patch confirmed \u2014 restrict access & monitor for abuse. Details: https://radar.offseq.com/threat/cve-2026-48909-cwe-502-deserialization-of-untruste-b0460f6997894c12 #OffSeq #Vulnerability...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3morex5l44o2t"}, {"timestamp": "2026-06-21T03:00:34.705Z", "date_only": false, "value": "2026-06-21T03:00:34.705588Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/116785861349829350", "record": "cve-2026-48909", "field": "creation_timestamp", "uuid": "703c1647-25f0-4ec2-8c96-0a0822a5fc63", "content": "JoomShaper SP LMS for Joomla (v1.0.0 \u2013 4.1.3) hit by CRITICAL vuln (CVE-2026-48909): unsafe cookie deserialization enables unauth RCE. No patch yet \u2014 restrict access & monitor traffic. Details: https://radar.offseq.com/threat/cve-2026-48909-cwe-502-deserialization-of-untruste-b0460f6997894c12 #OffSeq #Joomla #CVE #infosec", "url": "https://infosec.exchange/users/offseq/statuses/116785861349829350"}, {"timestamp": "2026-06-21T05:04:10.165Z", "date_only": false, "value": "2026-06-21T05:04:10.165057Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3morluejtd22v", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "d4107507-b848-4ea1-a995-6ea58b5b189e", "content": "Daily IT Security Digest \u2014 2026-06-21\nDeserialization**\nCRITICAL vulnerability (CVE-2026-48909) in JoomShaper SP LMS for Joomla (v1.0.0\u20134.1.3) allows unauthenticated remote code execution via unsafe cookie deserialization. No patch exists yet; administrators should restrict access and monitor", "url": "https://bsky.app/profile/hermes71.bsky.social/post/3morluejtd22v"}, {"timestamp": "2026-06-21T05:04:10.707Z", "date_only": false, "value": "2026-06-21T05:04:10.707998Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3morlues37w2j", "record": "cve-2026-48909", "field": "creation_timestamp", "uuid": "6a6b5cb0-a04a-4efc-8834-701ac70a85d6", "content": "Daily IT Security Digest \u2014 2026-06-21\nclosely.\nSources: [OffSeq Radar](https://radar.offseq.com/threat/cve-2026-48909) \u00b7 [infosec.exchange @offseq](https://infosec.exchange/@offseq/116785861349829350)\n\n**8. Rockstar Games Data Breach \u2014 ~80 Million Records Exposed**\nHackers claim to have stolen", "url": "https://bsky.app/profile/hermes71.bsky.social/post/3morlues37w2j"}, {"timestamp": "2026-06-22T17:44:42.382Z", "date_only": false, "value": "2026-06-22T17:44:42.382324Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-48909", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-06-22T17:44:42.382Z", "date_only": false, "value": "2026-06-22T17:44:42.382324Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48909", "record": "FKIE_CVE-2026-48909", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-06-22T17:44:50.120Z", "date_only": false, "value": "2026-06-22T17:44:50.120Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-48909", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-23T05:52:22.025Z", "date_only": false, "value": "2026-06-23T05:52:22.025Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-48909", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-06-23T05:52:22.025Z", "date_only": false, "value": "2026-06-23T05:52:22.025Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Joomla", "record": "cve-2026-48909", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-23T11:47:38.442Z", "date_only": false, "value": "2026-06-23T11:47:38.442781Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3moyeu62nn22k", "record": "cve-2026-48909", "field": "creation_timestamp", "uuid": "ae2f2312-8604-4f6b-b2e9-264b4cccc5d1", "content": "Tuesday\u2019s fuck up - this time Joomla & PHP - In SP LMS PHP Object Injection - RCE\nPOC  \u2264 4.1.3 for Joomla CMS github.com/Is4yev/CVE-2... #cve #poc #exploit #cve-2026-48909 #joomla #php", "url": "https://bsky.app/profile/toxy4ny.bsky.social/post/3moyeu62nn22k"}, {"timestamp": "2026-07-06T00:00:00Z", "date_only": false, "value": "2026-07-06T00:00:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://www.exploit-db.com/exploits/52617", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "6e95faf4-7490-46ef-adbf-e986194f3a72", "url": "https://www.exploit-db.com/exploits/52617", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-13T22:00:21.865Z", "date_only": false, "value": "2026-07-13T22:00:21.865014Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/90021", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "8e82a2a2-5f3f-4108-9a73-4c0e993df630", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48909\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Is4yev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-21 21:33:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-48909 PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/90021"}, {"timestamp": "2026-07-15T00:00:18.777Z", "date_only": false, "value": "2026-07-15T00:00:18.777629Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/90021", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "c5dddfd1-08da-4e7a-9353-c4a40e960613", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48909\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Is4yev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-21 21:33:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-48909 PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/90021", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-16T12:00:04.960Z", "date_only": false, "value": "2026-07-16T12:00:04.960158Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93601", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "71fd085e-8e17-4964-ae5e-5c39443628bc", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48909-Joomla-SP-Exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a CerberusMrXi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-15 20:31:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-48909 - Unauthenticated PHP Object Injection to RCE exploit for Joomla SP LMS extension versions <= 4.1.3. Exploits lmsOrders cookie deserialization to write webshell via Joomla FormattedtextLogger gadget chain. Includes interactive shell, path discovery, and cleanup. For authorized security testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93601", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-16T19:00:04.718Z", "date_only": false, "value": "2026-07-16T19:00:04.718730Z", "kind": "sighting", "label": "Seen", "source": "Telegram/aLUBIgd1oXw2vuhuFf6alCjtWAQyS8DwghI3-yppd5LMZjw", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "30347eab-ad9d-4059-ac36-edc47623e32f"}, {"timestamp": "2026-07-16T19:00:05.280Z", "date_only": false, "value": "2026-07-16T19:00:05.280273Z", "kind": "sighting", "label": "Seen", "source": "Telegram/fnq-HCCIjbhzeI4TC1ixQu82pH2CpmWc72Tdnvx0IlMjFVI", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "9f7ab8fa-b7be-489a-8274-f73f2dd18184"}, {"timestamp": "2026-07-17T00:00:25.882Z", "date_only": false, "value": "2026-07-17T00:00:25.882417Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/fnq-HCCIjbhzeI4TC1ixQu82pH2CpmWc72Tdnvx0IlMjFVI", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "74b9561b-42a1-4fab-9107-89c8cfef6972", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-17T00:00:26.072Z", "date_only": false, "value": "2026-07-17T00:00:26.072576Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/aLUBIgd1oXw2vuhuFf6alCjtWAQyS8DwghI3-yppd5LMZjw", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "44547c23-13f1-4030-84ac-4d76e4f77ccc", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-23T06:00:05.760Z", "date_only": false, "value": "2026-07-23T06:00:05.760097Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/javascript/cves/2026/CVE-2026-48909.yaml", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "a88a7916-fb4d-4855-a29d-c0faf5e07bab", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/javascript/cves/2026/CVE-2026-48909.yaml"}, {"timestamp": "2026-09-02T06:00:07.619Z", "date_only": false, "value": "2026-09-02T06:00:07.619188Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/HackingTeamGrupoOfficial/46893", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "2c055a40-3328-47ea-a1fa-ebb62fe77a69", "content": "CVE-2026-48909 \u2014 SP LMS PHP Object Injection - RCE\n*\nPOC  \u2264 4.1.3 for Joomla CMS", "url": "https://t.me/HackingTeamGrupoOfficial/46893"}, {"timestamp": "2026-09-03T00:00:51.244Z", "date_only": false, "value": "2026-09-03T00:00:51.244348Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackingTeamGrupoOfficial/46893", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "dee84b56-64c9-4193-8f6b-01d64f6447be", "content": "CVE-2026-48909 \u2014 SP LMS PHP Object Injection - RCE\n*\nPOC  \u2264 4.1.3 for Joomla CMS", "url": "https://t.me/HackingTeamGrupoOfficial/46893", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-25T11:00:13Z", "date_only": false, "value": "2026-09-25T11:00:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/AEwUmxTHfjK52gcCzirRg3eKj4ECkiyGcn3Hrgzjr8KwPNw", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "935fdeb8-1084-407e-907b-d4e27493ac23", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-25T11:00:13Z", "date_only": false, "value": "2026-09-25T11:00:13.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/AEwUmxTHfjK52gcCzirRg3eKj4ECkiyGcn3Hrgzjr8KwPNw", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "2e9283e4-0581-4ebf-9638-c0df3e064a5f"}, {"timestamp": "2026-10-25T23:10:00.167Z", "date_only": false, "value": "2026-10-25T23:10:00.167", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48909", "record": "FKIE_CVE-2026-48909", "field": "lastModified"}], "metrics": {"as_of": "2026-10-28T19:56:24.148Z", "anchors": {"origin": {"timestamp": "2026-06-20T11:56:46.771Z", "date_only": false, "value": "2026-06-20T11:56:46.771Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-48909", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-06-20T11:56:46.771Z", "date_only": false, "value": "2026-06-20T11:56:46.771Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-48909", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-07-06T00:00:00Z", "date_only": false, "value": "2026-07-06T00:00:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://www.exploit-db.com/exploits/52617", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "6e95faf4-7490-46ef-adbf-e986194f3a72", "url": "https://www.exploit-db.com/exploits/52617", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 1339393.229, "hours": 372.05367472222224, "days": 15.50223644675926, "min_seconds": 1339393.229, "max_seconds": 1425793.229, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-06-20T11:56:46.771Z", "date_only": false, "value": "2026-06-20T11:56:46.771Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-48909", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-07-06T00:00:00Z", "date_only": false, "value": "2026-07-06T00:00:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://www.exploit-db.com/exploits/52617", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "6e95faf4-7490-46ef-adbf-e986194f3a72", "url": "https://www.exploit-db.com/exploits/52617", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 11260777.377893, "hours": 3127.9937160813893, "days": 130.3330715033912, "min_seconds": 11260777.377893, "max_seconds": 11260777.377893, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-06-20T11:56:46.771Z", "date_only": false, "value": "2026-06-20T11:56:46.771Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-48909", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-28T19:56:24.148Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 9921384.148893, "hours": 2755.940041359167, "days": 114.83083505663195, "min_seconds": 9834984.148893, "max_seconds": 9921384.148893, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-06T00:00:00Z", "date_only": false, "value": "2026-07-06T00:00:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://www.exploit-db.com/exploits/52617", "record": "CVE-2026-48909", "field": "creation_timestamp", "uuid": "6e95faf4-7490-46ef-adbf-e986194f3a72", "url": "https://www.exploit-db.com/exploits/52617", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-28T19:56:24.148Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}