Summary
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Widget Factory Joomla Content Editor ausnutzen, um beliebigen Programmcode auszuführen.
Product
JCE ist eine WYSIWYG-Editor-Erweiterung für das Content-Management-System Joomla.
Vulnerabilities 1
-
Critical 10.0
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.
KEV Jun 16, 2026
Revision history
-
#1
Initiale Fassung
References
-
JCE Security Update vom 2026-06-17
https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites
-
National Vulnerability Database vom 2026-06-17
http://nvd.nist.gov/vuln/detail/CVE-2026-48907
-
CISA Known Exploited Vulnerabilities vom 2026-06-17
https://www.cisa.gov/news-events/alerts/2026/06/16/cisa-adds-one-known-exploited-vulnerability-catalog