Back to the CVE list
CVE-2026-49049Suited to automated attack · CISA

Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

CVSS score

7.5

EPSS probability

%1.0

Risk score

0.1

Published

3 mo ago

OverviewPublic Exploits (7)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
theendofabbys/CVE-2026-49049
GitHub

theendofabbys/CVE-2026-49049

Public PoCSource updated: 08.10.2026 03:37:36
G
MataKucing-OFC/CVE-2026-49049
GitHub

MataKucing-OFC/CVE-2026-49049

Public PoCSource updated: 12.09.2026 00:41:13
G
Jenderal92/CVE-2026-49049
GitHub

Mass vulnerability scanner for CVE-2026-49049 – Unauthenticated Remote Code Execution in Joomla Helix3 plugin. Multi‑threaded, detects both executed and raw PHP payloads.

Public PoCSource updated: 09.09.2026 17:39:55
G
ExDev994/CVE-2026-49049
GitHub

CVE-2026-49049 Helix3 (JoomShaper) Joomla Unauthenticated AJAX RCE Scanner

Public PoCSource updated: 13.07.2026 19:56:12
G
Dr-D25/CVE-2026-49049
GitHub

Dr-D25/CVE-2026-49049

Public PoCSource updated: 10.07.2026 08:32:09
G
shinthink/CVE-2026-49049
GitHub

Read-only vulnerability scanner for CVE-2026-49049 — Helix3 Joomla plugin unauthenticated AJAX handler

Public PoCSource updated: 04.09.2026 07:13:19
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49049.yaml
Nuclei

Nuclei: JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write

Exploit reference

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-49049"