CVE-2021-47753

CRITICAL

Phpkf Cms - Unrestricted File Upload

Title source: rule

Description

phpKF CMS 3.00 Beta y6 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary code by bypassing file extension checks. Attackers can upload a PHP file disguised as a PNG, rename it, and execute system commands through a crafted web shell parameter.

Exploits (1)

exploitdb WORKING POC
by Halit AKAYDIN · pythonwebappsphp
https://www.exploit-db.com/exploits/50610

References (3)

Scores

CVSS v3 9.8
EPSS 0.0026
EPSS Percentile 49.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (2)
phpkf/cms 3.00 beta_y6
Phpkf/phpKF CMS 3.00
Published Jan 15, 2026
Tracked Since Feb 18, 2026