/Vulnerability Library

Joomla SP LMS <= 4.1.3 - Remote Code Execution

CVE-2026-48909
Verified

Description

SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.

Severity

Critical

CVSS Score

9.5

Exploit Probability

5%

Affected Product

sp_lms

Published Date

July 22, 2026

Template Author

dhiyaneshdk

CVE-2026-48909.yaml
9.5Score

CVSS Metrics

CVSS Vector:
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVE ID:
cve-2026-48909
CWE ID:
cwe-502

References

https://github.com/CerberusMrXi/CVE-2026-48909-Joomla-SP-Exploithttps://github.com/Is4yev/CVE-2026-48909https://nvd.nist.gov/vuln/detail/CVE-2026-48909

Remediation Steps

Upgrade to version 4.1.4 or later.