CVE-2026-48909

Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4 PUBLISHED

Description (CNA)

SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.

Affected (CNA)

Vendor / product	Versions
joomshaper.net / SP LMS extension for Joomla	affected 1.0.0-4.1.3

CWE

CWE-502

References

https://www.joomshaper.com/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.