https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T20:12:26.938274+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-48909 CVE-2026-48909 — Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4 2026-10-07T20:12:26.939421+00:00

Affected: joomshaper.net SP LMS extension for Joomla

SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.