CVE-2021-47936

critical · 9.3

OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments. Attackers can upload PHP payloads through the careers job application endpoint and execute system commands via POST requests to the uploaded file in the upload directory.

9.3

CVSS

0.7%

EPSS (exploit prob.)

50th

EPSS percentile

2026-05-10

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-306

References

https://github.com/opencats/OpenCATS
https://www.exploit-db.com/exploits/50585
https://www.opencats.org/
https://www.vulncheck.com/advisories/opencats-remote-code-execution-via-resume-upload

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-47936