CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Joomla iCagenda Extension Arbitrary File Upload and Remote Code Execution Vulnerability (CVE-2026-48939)
[Affected Scope] Joomla iCagenda extension versions prior to 3.9.15 and 4.0.8
[Impact] Unauthenticated remote attackers can bypass file upload restrictions to upload malicious PHP scripts, leading to complete system compromise via Remote Code Execution (RCE).
[Mitigation] Immediately upgrade the iCagenda extension to the patched versions (3.9.15 / 4.0.8 or higher) and disable script execution in upload directories.
Joomla SP Page Builder Arbitrary File Upload and Remote Code Execution (RCE) Vulnerability (CVE-2026-48908)
[Affected Scope] Websites utilizing the SP Page Builder extension for Joomla
[Impact] Unauthenticated attackers can upload and execute malicious PHP code, leading to complete takeover of the web server
[Mitigation] Immediately update to the latest patched version, apply WAF rules, and disable PHP execution in upload directories