This repository contains selected Joomla exploit artifacts validated against real Docker Joomla environments. The collection is split by practical offensive utility.
Exploits with direct security impact: RCE, file upload to code execution, SQL injection, sensitive configuration disclosure, arbitrary file deletion, stored XSS against an administrator, or privilege escalation.
| Order | CVE | CVSS | Target | Exploit script |
|---|---|---|---|---|
| 1 | CVE-2026-48939 | 10.0 | iCagenda public event attachment upload | cve_2026_48939_icagenda_real_http_rce.py |
| 2 | CVE-2026-21628 | 10.0 | Astroid Framework com_ajax media file manager | cve_2026_21628_astroid_real_http_rce.py |
| 3 | CVE-2026-48907 | 10.0 | JCE com_jce profiles.import profile upload | cve_2026_48907_jce_real_http_rce.py |
| 4 | CVE-2026-48908 | 10.0 | SP Page Builder asset.uploadCustomIcon custom icon upload | cve_2026_48908_sppagebuilder_real_http_rce.py |
| 5 | CVE-2023-23753 | 9.8 | Visforms addSupportedFieldType | cve_2023_23753_visforms_real_http_sqli.py |
| 6 | CVE-2026-49048 | 9.8 | JoomCCK com_joomcck tags.save | cve_2026_49048_joomcck_real_http_sqli.py |
| 7 | CVE-2025-22204 | 9.8 | Regular Labs Sourcerer alternate PHP syntax | cve_2025_22204_sourcerer_real_http_rce.py |
| 8 | CVE-2025-26854 | 9.8 | Articles Good Search mod_articles_good_search | cve_2025_26854_articles_good_search_real_http_sqli.py |
| 9 | CVE-2025-26855 | 9.8 | Articles Calendar mod_articles_calendar | cve_2025_26855_articles_calendar_real_http_sqli.py |
| 10 | CVE-2024-40744 | 9.8 | Convert Forms com_convertforms | cve_2024_40744_convert_forms_real_http_upload_rce.py |
| 11 | CVE-2025-54298 | 9.4 | CommentBox comments.add User-Agent | cve_2025_54298_commentbox_real_http_stored_xss.py |
| 12 | CVE-2026-48906 | 9.3 | Tassos Framework GalleryManager2 delete | cve_2026_48906_tassos_real_http_delete.py |
| 13 | CVE-2025-49467 | 9.3 | JEvents com_jevents range.listevents enddate | cve_2025_49467_jevents_real_http_sqli.py |
| 14 | CVE-2025-54473 | 9.2 | Phoca Commander authenticated unpack action | cve_2025_54473_phoca_commander_real_http_rce.py |
| 15 | CVE-2025-54475 | 8.7 | JS Jobs employer package purchase | cve_2025_54475_jsjobs_real_http_sqli.py |
| 16 | CVE-2026-23898 | 8.6 | Joomla com_joomlaupdate finalizeUpdate API | cve_2026_23898_joomla_update_api_file_delete.py |
| 17 | CVE-2026-23899 | 8.6 | Joomla com_config application API | cve_2026_23899_joomla_config_api_access_bypass.py |
| 18 | CVE-2026-48898 | 8.2 | Joomla com_users batch task | cve_2026_48898_joomla_com_users_batch_privilege_escalation_real_http.py |
| 19 | CVE-2026-48904 | 8.2 | Joomla com_users groups API | cve_2026_48904_joomla_com_users_group_api_privilege_escalation_real_http.py |
PoCs that demonstrate real vulnerabilities but are less directly useful as standalone intrusion primitives. They are retained for research, chaining, or defensive validation.
| Order | CVE | CVSS | Target | Exploit script |
|---|---|---|---|---|
| 1 | CVE-2024-27185 | 9.1 | Joomla core com_content pagination cache handling | cve_2024_27185_joomla_pagination_cache_poison.py |
| 2 | CVE-2026-48902 | 9.8 | Joomla CMS core com_users reset/remind | cve_2026_48902_joomla_reset_link_downgrade.py |
| 3 | CVE-2026-48896 | 8.2 | Joomla Core MFA | cve_2026_48896_joomla_mfa_bypass_real_http.py |
| 4 | CVE-2026-48897 | 8.2 | Joomla Core MFA session state | cve_2026_48897_joomla_mfa_session_state_bypass_real_http.py |
| 5 | CVE-2026-35223 | 8.6 | Joomla com_config component API | cve_2026_35223_joomla_component_config_api_access_bypass.py |
| 6 | CVE-2025-54300 | 8.5 | Quantum Manager SVG upload | cve_2025_54300_quantum_manager_real_http_stored_xss.py |
| 7 | CVE-2025-54301 | 8.5 | Quantum Manager filename rendering | cve_2025_54301_quantum_manager_real_http_filename_xss.py |
- Enter one CVE directory under
real-impact/orconceptual-pocs/. - Start the lab when a
docker-compose.ymlis present:docker compose up -d. - Read the CVE
README.mdand, when present,exploits/README.mdfor setup notes. - Run the exploit script from the CVE directory or pass the target URL explicitly.
No proprietary vulnerable extension ZIPs or Joomla distribution ZIPs are included. Download vulnerable software from the links in each CVE README and test only in authorized local labs.
Three records that were previously mistaken for public exploits remain gated on unavailable commercial or historical packages. Their exact blockers are documented in unvalidated-candidates and no unvalidated exploit is published for them.
CVE-2025-54300 and CVE-2025-54301 were validated through real Quantum Manager 3.2.0 HTTP routes in Joomla Docker using unchanged source from official commit 1bf656d. That source package did not complete Joomla's standard installer, so the lab copied the official component files into Joomla and registered its metadata manually. Their directories document this limitation and include the registration SQL; they do not claim a one-command clean installation or redistribute vulnerable packages.