We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2021-47936

CVE-2021-47936

PHP

Severity: CRITICAL
CVSS: 9.8CVSS
Published: 2026-05-10
Last modified: 2026-05-10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-306

Description

OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments. Attackers can upload PHP payloads through the careers job application endpoint and execute system commands via POST requests to the uploaded file in the upload directory.

References

https://github.com/opencats/OpenCATS
https://www.exploit-db.com/exploits/50585
https://www.opencats.org/
https://www.vulncheck.com/advisories/opencats-remote-code-execution-via-resume-upload

Summary

Description

References