CVE-2021-45807
Critical · CVSS 9.8JPress — Remote Code Execution via malicious addon upload
- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- NVD-CWE-noinfo
Description
jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin._AddonController::doUploadAndInstall.
Search profile — drives PoC discovery
Symbols io.jpress.web.admin._AddonControllerdoUploadAndInstall_AddonControllerAddonControllerdoUploadAndInstall
Keywords CVE-2021-45807JPressjpress v4.2.0command executionaddon uploaddoUploadAndInstallAddonControllerRCEjpress exploitjpress PoC
Versions: v4.2.0
References
Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T06:30:39.000Z