CISA added CVE-2026-48939 and CVE-2026-56291 to its Known Exploited Vulnerabilities catalog after automated attackers exploited file upload flaws in iCagenda and Balbooa Forms weeks before either bug had a CVE number.

Two Joomla Extensions Hit by Zero-Day File Upload Attacks Before Patches Landed on Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses.

Rebecca Sutton

Source: LatestHackingNews
Source Link: https://latesthackingnews.com/2026/07/15/joomla-file-upload-vulnerabilities/