CVE WatchJul 9, 2026

CVE-2021-36581

Kooboo CMS 2.1.1.0 is vulnerable to Insecure file upload. It is possible to upload any file extension to the server. The server does not ver

CVSS

9.8

Critical

EPSS

1.4%

p70

KEV

—

Exploit Today

0-100

Published: Sep 14, 2021 · Last modified: Jul 9, 2026 · CWE-434

EPSS · 30d

1.4%EPSS · 30 days1.5%

2026-06-302026-07-16

Technical description

Kooboo CMS 2.1.1.0 is vulnerable to Insecure file upload. It is possible to upload any file extension to the server. The server does not verify the extension of the file and the tester was able to upload an aspx to the server.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-562909.8 CRI

85.4%

KEV—76Joomlack Page Builder Improper Access Control Vulnerability9d CVE-2026-489089.8 CRI

72.6%

KEV—72JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability9d CVE-2026-489399.8 CRI

71.5%

KEV—71iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability6d CVE-2026-562919.8 CRI

53.6%

KEV—66Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability6d CVE-2023-388368.8 HIG

99.3%

——30File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.8d CVE-2023-464747.2 HIG

97.3%

——29File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uploaded to the start_import.php file.8d