CVE-2021-27817

—

CVSS 3.1

9.8 critical

EPSS

3%p87

Published

Mar 15, 2021 (Mar 15, 2021)

Modified

Jun 17, 2026

Description

A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix.

Vendors: shopxo
Products: shopxo
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.2%)

In the news0 stories

No ingested article mentions this CVE yet.