ExDev994/CVE-2026-49049

PoC

CVE-2026-49049 Helix3 (JoomShaper) Joomla Unauthenticated AJAX RCE Scanner

view exploit source poc_in_githubauthor ExDev994published 2026-07-13catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-49049US	—OT critical	0.99% (62nd)	Exploit	2026-06-29
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameter…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.