Widget Factory Joomla Content Editor Improper Access Control Vulnerability

PoC: JCEzploit-CVE-2026-48907

JCEzploit is a powerful, fully-automated RCE exploit for Joomla JCE (CVE-2026-48907) featuring interactive shell, batch command execution, file download capability, and proxy support. Built with Python & Rich for penetration testers. Ethical use only. By Sudeepa Wanigarathna.

PoC: CVE-2026-48907_PoC

Unauthenticated Remote Code Execution (RCE) vulnerability in the JCE (Joomla Content Editor) extension for Joomla

PoC: CVE-2026-48907-Joomla-JCE-RCE

CVE-2026-48907 - Joomla JCE Editor Unauthenticated RCE - PoC & Analysis | CVSS 9.8 CRITICAL | AMN SECURITY

[POC] GHSA-2j8v-hwgc-x698 — CVE-2026-48907

CVE-2026-48907 PoC

[POC] GHSA-2j8v-hwgc-x698 — CVE-2026-48907

POC for CVE-2026-48907

[POC] MAL-2026-2307 — CVE-2026-48907

CVE-2026-48907 – Joomla JCE Unauthenticated Remote Code Execution (RCE)

[POC] MAL-2026-2307 — CVE-2026-48907

CVE-2026-48907 is a CVSS 10.0 pre-auth RCE in Joomla Content Editor affecting all versions ≤ 2.9.99.4. The Grayxploit team breaks down the 3-weakness chain — missing auth, no extension validation, and an unsafe upload flag — that lets attackers pop a shell in 3 HTTP requests.

[POC] MAL-2026-2307 — masta-cve-2026-48907

cve-2026-48907 scanner

[POC] GHSA-3mgp-fx93-9xv5 — CVE-2026-48907

CVE-2025-48907 - Unauthenticated RCE exploit for Joomla JCE < 2.9.99.5

[POC] CVE-2026-48907 — joomla-jce-cve-2026-48907-detection

Defensive lab validation and SOC detection guidance for CVE-2026-48907 in Joomla JCE <= 2.9.99.4, including Apache/Joomla/auditd telemetry, webshell artifacts, Sigma rules, MITRE ATT&CK mapping and mitigation recommendations.

[POC] CVE-2026-48907 — CVE-2026-48907

CVE-2026-48907 is a critical improper access control vulnerability in the JCE editor extension for Joomla. It allows unauthenticated attackers to create new editor profiles, which can ultimately lead to arbitrary PHP file upload and remote code execution on affected systems

[POC] CVE-2026-48907 — CVE-2026-48907

CVE-2026-48907

[POC] CVE-2026-48907 — CVE-2026-48907

CVE-2026-48907

PoC: CVE-2026-48907

Python & template nuclei

PoC: Joomla_CVE_2026_48907

cve-2026-48907 scanner

PoC: CVE-2026-48907

PoC for CVE-2026-48907 - Joomla! JCE extension < 2.9.99.5 unauthenticated RCE

PoC: CVE-2026-48907-Unauthenticated-RCE-in-JCE

CVE-2026-48907: Unauthenticated RCE in JCE (Proof Of Concept)