{"uuid": "aab9d24e-ab0b-4b9e-bb87-b1c82c8e460c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48907", "type": "seen", "source": "https://t.me/HackingTeamGrupoOfficial/46690", "content": "\ud83d\udea8 CVE-2026-48907 \u2014 JoomlaSniper v1.0 released\n\nUnauthenticated RCE in Joomla JCE Editor (\u22642.9.99.4)\nCVSS 10.0 \u2022 Affects ALL production versions\n\nFile upload \u2192 PHP execution in /tmp/ \u2014 no auth required\n\n\ud83d\udd17 http://github.com/ynsmroztas/JoomlaSniper\n\nTool features:\n\n\u2705 Dual vector (tmp/ + JCE browser)\n\u2705 Interactive shell\n\u2705 Zero dependencies (stdlib only)\n\u2705 Pipeline: subfinder | httpx | JoomlaSniper\n\u2705 Multi-function fallback (shell_exec \u2192 system \u2192 passthru)\n\u2705 Auto store code detection\n\nFixed in JCE 2.9.99.5\n\nQuick test:\n\npython3 http://JoomlaSniper.py -u http://target.com --shell\n\nSubdomain tarama:\n\nsubfinder -d http://target.com | httpx -silent | python3 http://JoomlaSniper.py\n\n#BugBounty #InfoSec #RedTeam #AppSec #bugbountytip #bugbountytips #infosec #recon", "creation_timestamp": "2026-09-02T06:00:07.518598Z"}