Joomshaper.net vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Joomshaper.net products: 2 record(s), with severity, exploitation and fixes.

SP Page Builder extension for Joomla 1 SP LMS extension for Joomla 1

Exploited only (KEV) →

CVE-2026-48909 Critical · 9.5 Public exploit CWE-502 Jun 20, 2026

JoomShaper SP LMS (com_splms) Joomla Component Insecure Deserialization of Cookie Data

SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.

CVE-2026-48908 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-434 Jun 20, 2026

JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.