PT-2026-51136

CVE-2026-48909

Published

2026-06-20

Updated

2026-07-07

Description by

CVSS 4.0

9.5

Critical

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions SP LMS versions prior to 4.1.4

Description SP LMS (com splms) by JoomShaper contains a PHP Object injection flaw where user-controlled cookie data is deserialized without validation. Specifically, the application passes the lmsOrders cookie to an unsafe unserialize() function before authentication. This allows an unauthenticated remote attacker to trigger a native gadget chain to drop a web shell and execute arbitrary code on the server.

Recommendations Update to version 4.1.4.

Exploitability

Exploit

Fix

Impacts

Researchers

Amin Isayev

Vendors

Affected products

Weakness enumeration

CWE-502: Deserialization of Untrusted Data

Related identifiers