https://poc.intelseclab.com/tags/joomla/Latest proof-of-concept entries.Hugoen-usMon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-57830-joomla-helix-ultimate-file-deletion/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-57830-joomla-helix-ultimate-file-deletion/Critical severity (CVSS 9.1) — web · CVE-2026-57830. Status: Weaponized. Affects: Helix Ultimate Framework (plg_system_helixultimate), the JoomShaper Joomla template framework bundled with virtually every JoomShaper Joomla template. Tags: joomla, helix-ultimate, joomshaper, arbitrary-file-deletion, cwe-862, unauthenticated, csrf-token-only-check.webCriticaljoomlahelix-ultimatejoomshaperarbitrary-file-deletioncwe-862unauthenticatedcsrf-token-only-checkhttps://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-56291-joomla-balbooa-forms-file-upload-rce/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-56291-joomla-balbooa-forms-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2026-56291. Status: Weaponized. Affects: Balbooa Forms (com_baforms) — third-party Joomla! extension by balbooa.com. Tags: joomla, balbooa-forms, file-upload, webshell, unauthenticated, rce, kev, actively-exploited, cwe-434.webCriticaljoomlabalbooa-formsfile-uploadwebshellunauthenticatedrcekevactively-exploitedcwe-434https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-48939-icagenda-joomla-file-upload-rce/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-48939-icagenda-joomla-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2026-48939. Status: Weaponized (public PoC available, actively exploited in the wild, in CISA KEV since 2026-07-10). Affects: iCagenda — events/calendar extension (component) for Joomla. Tags: joomla, icagenda, file-upload, rce, cwe-434, unauthenticated, remote, kev, cms, php, access-control-bypass.webCriticaljoomlaicagendafile-uploadrcecwe-434unauthenticatedremotekevcmsphpaccess-control-bypasshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48909-sp-lms-joomla-phpobjectinjection-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48909-sp-lms-joomla-phpobjectinjection-rce/Critical severity (CVSS 9.5) — web · CVE-2026-48909 (GHSA-gf8c-xmwj-whrh). Status: PoC. Affects: JoomShaper SP LMS (com_splms) Joomla Learning Management System extension. Tags: joomla, sp-lms, com_splms, php-object-injection, cwe-502, deserialization, unauthenticated-rce, gadget-chain.webCriticaljoomlasp-lmscom_splmsphp-object-injectioncwe-502deserializationunauthenticated-rcegadget-chainhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-56290-joomla-pagebuilderck-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-56290-joomla-pagebuilderck-rce/Critical severity (CVSS 9.8) — web · CVE-2026-56290. Status: PoC. Affects: Page Builder CK (com_pagebuilderck) — Joomla extension. Tags: joomla, page-builder-ck, com_pagebuilderck, file-upload, unauth-rce, csrf, cms.webCriticaljoomlapage-builder-ckcom_pagebuilderckfile-uploadunauth-rcecsrfcmshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-21627-joomla-nrframework-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-21627-joomla-nrframework-rce/Critical severity (CVSS 9.5) — web · CVE-2026-21627. Status: Weaponized. Affects: plg_system_nrframework (Tassos/Novarain Framework) Joomla plugin, bundled with Convert Forms, Engage Box, Google Structured Data, and other Tassos.gr extensions. Tags: joomla, nrframework, file-inclusion, unauthenticated, arbitrary-file-upload, arbitrary-file-delete, php, cms.webCriticaljoomlanrframeworkfile-inclusionunauthenticatedarbitrary-file-uploadarbitrary-file-deletephpcmshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49048-joomcck-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49048-joomcck-sqli/Critical severity (CVSS 8.7) — web · CVE-2026-49048 (Advisory ID JOOMCCK-2026-001). Status: PoC. Affects: JoomCCK (com_joomcck) — Content Construction Kit extension for Joomla, by JoomCoder. Tags: joomla, joomcck, com_joomcck, sql-injection, cwe-89, missing-authorization, cwe-862, unauthenticated, blind-sqli, union-based.webCriticaljoomlajoomcckcom_joomccksql-injectioncwe-89missing-authorizationcwe-862unauthenticatedblind-sqliunion-basedhttps://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-48907-joomla-jce-unauth-rce/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-48907-joomla-jce-unauth-rce/Critical severity (CVSS 10) — web · CVE-2026-48907. Status: Weaponized. Affects: Joomla Content Editor (JCE) extension by Widget Factory. Tags: RCE, unauthenticated, Joomla, JCE, CMS, access-control, webshell, php-webshell, file-upload, CISA-KEV, active-exploitation.webCriticalRCEunauthenticatedJoomlaJCECMSaccess-controlwebshellphp-webshellfile-uploadCISA-KEVactive-exploitationhttps://poc.intelseclab.com/pocs/web/2026-06-30_cve-2026-48908-sp-page-builder-joomla-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-06-30_cve-2026-48908-sp-page-builder-joomla-rce/Critical severity (CVSS 10) — web · CVE-2026-48908 (GHSA-8fwr-8fxr-8v2p). Status: Weaponized — public PoC with mass-scan support, added to CISA KEV 2026-07-07, confirmed active in-the-wild exploitation. Affects: SP Page Builder extension for Joomla (joomshaper.net). Tags: RCE, unauthenticated, file-upload, PHP-webshell, Joomla, CMS, access-control, Python, CVSS-10, kev, backdoor, cwe-434.webCriticalRCEunauthenticatedfile-uploadPHP-webshellJoomlaCMSaccess-controlPythonCVSS-10kevbackdoorcwe-434