VULNERABILITY INTELLIGENCE

CVE-2021-27817

CVSS score9.8 CRITICAL
EPSS probability3.23%
CISA KEVNot currently listed
Published2021-03-15
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix.

Weakness classification

  • nvd@nist.gov: CWE-434

Primary references