CVE-2021-36582
Critical · CVSS 9.8Kooboo CMS — Unrestricted File Upload (Remote Shell Upload / RCE)
- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- other
- CWE-434
Description
In Kooboo CMS 2.1.1.0, it is possible to upload a remote shell (e.g., aspx) to the server and then call upon it to receive a reverse shell from the victim server. The files are uploaded to /Content/Template/root/reverse-shell.aspx and can be simply triggered by browsing that URL.
Search profile — drives PoC discovery
Symbols /Content/Template/root/reverse-shell.aspxreverse-shell.aspxContent/Template/root
Keywords CVE-2021-36582Kooboo CMSfile uploadreverse shellaspx shell uploadunrestricted file uploadCMS shell uploadKooboo CMS RCEKooboo CMS 2.1.1.0
Versions: 2.1.1.0
Ranked PoCs (2) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 0
- ★ 585Taoviqinvicible/Tools-termux needs reviewgh_search
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
References
Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T06:30:39.000Z