CVE-2026-48907

CVE-2026-48907 is a critical improper access control vulnerability in the JCE editor extension for Joomla. It allows unauthenticated attackers to create new editor profiles, which can ultimately lead to arbitrary PHP file upload and remote code execution on affected systems

Also if you want webshell you can use any webshell just rename it to alfa.php or use customized name php but you have to change the name in python code so just enjoy your life one More thing never use nuclei that was installed from shitty python pypi always use go version nuclei for better result httpx for better performance and first validate it and run it

but after thing i want why not to use nuclei for this purpose so i maded custom yaml nuclei script so dont waste on webshell time finding it have fun

Code: nuclei -t r.y --validate If it says nothing error then you can use as nuclei -l targets.txt -t r.yaml