Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-20 | 1 | General1 |
| 2026-06-21 | 2 | Active Exploitation1Disclosure1 |
| 2026-06-22 | 2 | PoC2 |
| 2026-06-23 | 1 | PoC1 |
| 2026-06-27 | 1 | Exploit1 |
| 2026-07-06 | 1 | Patch1 |
| 2026-07-07 | 1 | Disclosure1 |
| 2026-07-23 | 1 | Disclosure1 |
🚨 CVE-2026-48909: SP LMS PHP Object Injection to RCE CVSS: 9.5 Published: June 21st, 2026 PoC: https://github.com/Is4yev/CVE-2026-48909 https://t.co/tkZ1brhcsL
Post summary
The tweet announces CVE-2026-48909 with a high CVSS score, provides a direct PoC link that demonstrates RCE, but offers no evidence of active exploitation or remediation steps.
Top CVEs w/ public exploits (Jun 20–27): CVE-2026-48908 Joomla SPB RCE (exploited live) CVE-2026-48909 Joomla SP LMS PHP Obj injection CVE-2026-12417 SignUp/In admin takeover CVE-2026-12416 Invoice Generator takeover CVE-2026-39938 Cacti LFI Protect via http://exploitgrid.net
Post summary
The post catalogs several CVEs with publicly available exploits, noting that at least one is actively being used in the wild, but offers no patch or mitigation information.
https://github.com/Is4yev/CVE-2026-48909
Post summary
The GitHub repository hosts a proof‑of‑concept exploit for CVE‑2026‑48909, detailing the vulnerability and providing execution code, but it does not indicate active exploitation or mention patches.
🚨 CVE-2026-48909 - critical 🚨 Joomla SP LMS <= 4.1.3 - Remote Code Execution > SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data wit... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-48909 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet announces CVE‑2026‑48909, a critical remote code execution flaw affecting Joomla SP LMS versions 4.1.3 and earlier, and directs readers to a ProjectDiscovery library page for further details.
Joomla SP LMS PHP object injection (CVE-2026-48909) allows RCE via lmsOrders cookie. Update to 4.1.4 or Joomla 5.2.2 to mitigate. For More: https://www.redsecuretech.co.uk/blog/post/joomla-sp-lms-php-object-injection-leads-to-rce/1306 #Joomla #SPLMS #PHPObjectInjection #CVE202648909 #Unserialize #Webshell #RCE #InfoSec #CyberSecurity https://t.co/B5v4FrwkX8
Post summary
The post warns of a Joomla SP LMS PHP object injection flaw (CVE-2026-48909) that allows RCE via the lmsOrders cookie and recommends updating to version 4.1.4 or Joomla 5.2.2 for remediation.
Joomla Extension - http://joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4 CVE: CVE-2026-48909 PT ID: PT-2026-51136 Vendor: Joomla (http://joomshaper.net) Product: SP LMS extension for Joomla CVSS: 9.5 Credits: Amin Isayev Description: SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-48909 • https://www.joomshaper.com/ PoC/Exploit: https://github.com/Is4yev/CVE-2026-48909 #dbugs_vuln
Post summary
An active proof‑of‑concept exploit for CVE‑2026‑48909 targeting the SP LMS Joomla extension is publicly available, confirming its vulnerability to remote code execution via object injection.
CVE-2026-48909 is a PHP object injection in JoomShaper SP LMS <= 4.1.3 via the lmsOrders cookie, triggering FormattedtextLogger.__destruct() to write a webshell. On Joomla < 5.2.2, this achieves RCE. #DFIR_Radar https://t.co/7uES7ycuuv
Post summary
The post announces the discovery of CVE-2026-48909, detailing how a PHP object injection in JoomShaper SP LMS allows webshell creation and RCE on Joomla sites.
Our CTI team identified a lot of activities targeting http://joomshaper.net SP LMS Extension (CVE-2026-48909) https://vuldb.com/vuln/372540/cti
Post summary
The CTI team reports multiple activities targeting CVE‑2026‑48909, indicating active exploitation, but provides no technical details, PoC, or mitigation information.
CVE-2026-48909 (CVSS 9.5): SP LMS by JoomShaper < 4.1.4 allows unauthenticated remote code execution. Review and update affected Joomla sites promptly. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/1ZMu2XQWAe
Post summary
The tweet announces CVE-2026-48909, a high‑severity RCE vulnerability affecting SP LMS on Joomla prior to 4.1.4, and urges sites to apply updates promptly.
CVE-2026-48909 Unauthenticated Remote Code Execution in SP LMS Below 4.1.4 via Deserialization https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48909
Post summary
A CVE for SP LMS is disclosed, indicating unauthenticated RCE through deserialization in versions under 4.1.4, but no PoC, exploit, patch, or active exploitation details are provided.