xitexploiter96-dot/cve-2026-48907-Python-based scanner and exploit for CVE-2026-48907, a critical unauthenticated RCE in Joomla JCE Editor. Features safe fingerprinting, CSRF token extraction, multi-threaded mass scanning, and full exploitation chain with 5 PHP payload variants.
CVSS 10.0 | CWE-284 | CISA KEV | EPSS 80%
A Python-based vulnerability scanner and exploitation tool for CVE-2026-48907, a critical unauthenticated remote code execution vulnerability in the JCE (Joomla Content Editor) extension for Joomla CMS.
| Field | Value |
|---|
| CVE ID | CVE-2026-48907 |
| Severity | Critical (CVSS 10.0) |
| CWE | CWE-284 — Improper Access Control |
| CISA KEV | ✅ Yes (added 2026-06-16) |
| EPSS | 80.4% (high probability of exploitation) |
| Attack Vector | Network |
| Authentication | None required |
| User Interaction | None |
| Affected Software | JCE (Joomla Content Editor) versions < 2.9.99.5 |
| Fixed In | JCE 2.9.99.6 |
A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution. The root cause is an improper access control check (CWE-284) on the profiles.import endpoint at index.php?option=com_jce&task=profiles.import.
jce.xmlordering:-99999, enabling PHP uploads, disabling MIME/extension validationrequests librarypip install requests
python cve-2026-48907.py -t https://target.com
python cve-2026-48907.py -t https://target.com --exploit
python cve-2026-48907.py -t https://target.com --exploit --proxy http://127.0.0.1:8080
python cve-2026-48907.py -l targets.txt --exploit -o scan_results.txt --threads 20