VULNERABILITY INTELLIGENCE
CVE-2026-48909
EPSS probability4.94%
CISA KEVNot currently listed
Published2026-06-20
Last modified2026-10-25
Description
SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.
Weakness classification
- security@joomla.org: CWE-502