H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Vulnerability

CVE-2026-48907

Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.

Vulnerability
TypeVulnerability
External ID—
First seen2026-06-16
Last seen2026-06-16

Confidence

—

Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.

Labels

exploitedkev

CISA KEV context

Vendor / productWidget Factory Joomla Content Editor
Added2026-06-16
Due date2026-06-19
18 recorded

Relationships

mitigates
from Remediate CVE-2026-48907
Mitigation
related-to
to Add Malicious File to Shared Webroot
Technique
related-to
to Data Injected During Configuration
Technique
related-to
to Disable Security Software
Technique
related-to
to Embedding Scripts within Scripts
Technique
related-to
to Incomplete Data Deletion in a Multi-Tenant Environment
Technique
related-to
to Install New Service
Technique
related-to
to Install Rootkit
Technique
related-to
to Intent Spoof
Technique
related-to
to Malicious Logic Insertion
Technique
related-to
to Malicious Root Certificate
Technique
related-to
to Modification of Windows Service Configuration
Technique
related-to
to Modify Existing Service
Technique
related-to
to Modify Shared File
Technique
related-to
to Replace File Extension Handlers
Technique
related-to
to Replace Trusted Executable
Technique
related-to
to Run Software at Logon
Technique
related-to
to WebView Exposure
Technique
2 external

References

nvd
CVE-2026-48907
open
cwe
CWE-284
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance