{"vulnerability": "cve-2026-48909", "sightings": [{"uuid": "661b8d17-cdc3-46c3-a12c-d35f47af3463", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48909", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mopyrpawac2a", "content": "CVE-2026-48909 - Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla\nCVE ID : CVE-2026-48909\n \n Published : June 20, 2026, 11:56 a.m. | 1\u00a0hour, 13\u00a0minutes ago\n \n Description : SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-con...", "creation_timestamp": "2026-06-20T13:49:58.589839Z"}, {"uuid": "8b3d1c5d-ab83-45ab-9594-ab6b6f23c11c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48909", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3morex5l44o2t", "content": "Critical deserialization issue in JoomShaper SP LMS (Joomla, v1.0.0 \u2013 4.1.3): Unauthenticated RCE possible. No patch confirmed \u2014 restrict access & monitor for abuse. Details: https://radar.offseq.com/threat/cve-2026-48909-cwe-502-deserialization-of-untruste-b0460f6997894c12 #OffSeq #Vulnerability...", "creation_timestamp": "2026-06-21T03:00:27.502416Z"}, {"uuid": "703c1647-25f0-4ec2-8c96-0a0822a5fc63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48909", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116785861349829350", "content": "JoomShaper SP LMS for Joomla (v1.0.0 \u2013 4.1.3) hit by CRITICAL vuln (CVE-2026-48909): unsafe cookie deserialization enables unauth RCE. No patch yet \u2014 restrict access & monitor traffic. Details: https://radar.offseq.com/threat/cve-2026-48909-cwe-502-deserialization-of-untruste-b0460f6997894c12 #OffSeq #Joomla #CVE #infosec", "creation_timestamp": "2026-06-21T03:00:34.705588Z"}, {"uuid": "d4107507-b848-4ea1-a995-6ea58b5b189e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48909", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3morluejtd22v", "content": "Daily IT Security Digest \u2014 2026-06-21\nDeserialization**\nCRITICAL vulnerability (CVE-2026-48909) in JoomShaper SP LMS for Joomla (v1.0.0\u20134.1.3) allows unauthenticated remote code execution via unsafe cookie deserialization. No patch exists yet; administrators should restrict access and monitor", "creation_timestamp": "2026-06-21T05:04:10.165057Z"}, {"uuid": "6a6b5cb0-a04a-4efc-8834-701ac70a85d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48909", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3morlues37w2j", "content": "Daily IT Security Digest \u2014 2026-06-21\nclosely.\nSources: [OffSeq Radar](https://radar.offseq.com/threat/cve-2026-48909) \u00b7 [infosec.exchange @offseq](https://infosec.exchange/@offseq/116785861349829350)\n\n**8. Rockstar Games Data Breach \u2014 ~80 Million Records Exposed**\nHackers claim to have stolen", "creation_timestamp": "2026-06-21T05:04:10.707998Z"}, {"uuid": "ae2f2312-8604-4f6b-b2e9-264b4cccc5d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48909", "type": "seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3moyeu62nn22k", "content": "Tuesday\u2019s fuck up - this time Joomla & PHP - In SP LMS PHP Object Injection - RCE\nPOC  \u2264 4.1.3 for Joomla CMS github.com/Is4yev/CVE-2... #cve #poc #exploit #cve-2026-48909 #joomla #php", "creation_timestamp": "2026-06-23T11:47:38.442781Z"}, {"uuid": "8e82a2a2-5f3f-4108-9a73-4c0e993df630", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48909", "type": "seen", "source": "https://t.me/GithubRedTeam/90021", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48909\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Is4yev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-21 21:33:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-48909 PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:21.865014Z"}, {"uuid": "e8ef53df-7f35-43b7-a867-6edf30738a31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48909", "type": "seen", "source": "https://t.me/GithubRedTeam/90021", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48909\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Is4yev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-21 21:33:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-48909 PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:37.748875Z"}, {"uuid": "c5dddfd1-08da-4e7a-9353-c4a40e960613", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48909", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/90021", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48909\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Is4yev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-21 21:33:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-48909 PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:18.777629Z"}, {"uuid": "71fd085e-8e17-4964-ae5e-5c39443628bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48909", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93601", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48909-Joomla-SP-Exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a CerberusMrXi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-15 20:31:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-48909 - Unauthenticated PHP Object Injection to RCE exploit for Joomla SP LMS extension versions <= 4.1.3. Exploits lmsOrders cookie deserialization to write webshell via Joomla FormattedtextLogger gadget chain. Includes interactive shell, path discovery, and cleanup. For authorized security testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-16T12:00:04.960158Z"}, {"uuid": "30347eab-ad9d-4059-ac36-edc47623e32f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48909", "type": "seen", "source": "Telegram/aLUBIgd1oXw2vuhuFf6alCjtWAQyS8DwghI3-yppd5LMZjw", "content": "", "creation_timestamp": "2026-07-16T19:00:04.718730Z"}, {"uuid": "9f7ab8fa-b7be-489a-8274-f73f2dd18184", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48909", "type": "seen", "source": "Telegram/fnq-HCCIjbhzeI4TC1ixQu82pH2CpmWc72Tdnvx0IlMjFVI", "content": "", "creation_timestamp": "2026-07-16T19:00:05.280273Z"}, {"uuid": "74b9561b-42a1-4fab-9107-89c8cfef6972", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48909", "type": "published-proof-of-concept", "source": "Telegram/fnq-HCCIjbhzeI4TC1ixQu82pH2CpmWc72Tdnvx0IlMjFVI", "content": "", "creation_timestamp": "2026-07-17T00:00:25.882417Z"}, {"uuid": "44547c23-13f1-4030-84ac-4d76e4f77ccc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48909", "type": "published-proof-of-concept", "source": "Telegram/aLUBIgd1oXw2vuhuFf6alCjtWAQyS8DwghI3-yppd5LMZjw", "content": "", "creation_timestamp": "2026-07-17T00:00:26.072576Z"}, {"uuid": "10315231-05ab-42cc-a80c-590af04962d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48909", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93601", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48909-Joomla-SP-Exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a CerberusMrXi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-15 20:31:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-48909 - Unauthenticated PHP Object Injection to RCE exploit for Joomla SP LMS extension versions <= 4.1.3. Exploits lmsOrders cookie deserialization to write webshell via Joomla FormattedtextLogger gadget chain. Includes interactive shell, path discovery, and cleanup. For authorized security testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-17T00:00:55.100772Z"}, {"uuid": "a88a7916-fb4d-4855-a29d-c0faf5e07bab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48909", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/javascript/cves/2026/CVE-2026-48909.yaml", "content": "", "creation_timestamp": "2026-07-23T06:00:05.760097Z"}, {"uuid": "162f3ff0-199a-494c-b7fb-b2b45f03ff13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48909", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/javascript/cves/2026/CVE-2026-48909.yaml", "content": "", "creation_timestamp": "2026-07-24T00:00:04.111528Z"}, {"uuid": "52c4069c-e46c-4ac2-ba4c-c4fae6bcf7ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48909", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/javascript/cves/2026/CVE-2026-48909.yaml", "content": "", "creation_timestamp": "2026-07-25T00:00:03.913633Z"}, {"uuid": "9227967d-e592-4436-8458-8e8b63d2e604", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48909", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/javascript/cves/2026/CVE-2026-48909.yaml", "content": "", "creation_timestamp": "2026-07-26T00:00:03.317328Z"}]}