CVE-2021-47794

HIGH

8.8

Descricao

ZesleCP 3.1.9 contains an authenticated remote code execution vulnerability that allows attackers to create malicious FTP accounts with shell injection payloads. Attackers can exploit the FTP account creation endpoint by injecting a reverse shell command that establishes a network connection to a specified listening host.

Detalhes CVE

Pontuacao CVSS v3.18.8

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado1/16/2026

Ultima modificacao1/21/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

zesle:zeslecp

Fraquezas (CWE)

CWE-78

Referencias

https://www.exploit-db.com/exploits/50233(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/zeslecp-remote-code-execution-rce-authenticated(disclosure@vulncheck.com)

https://www.youtube.com/watch?v=5lTDTEBVq-0(disclosure@vulncheck.com)

https://zeslecp.com/(disclosure@vulncheck.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.