CVE-2021-47794
ZesleCP 3.1.9 - Remote Code Execution (RCE) (Authenticated)
- State
- Published
- Severity
- 8.7 High
- Published
- Jan 15, 2026
- Updated
- Mar 5, 2026
- Reserved
- Jan 14, 2026
Description
ZesleCP 3.1.9 contains an authenticated remote code execution vulnerability that allows attackers to create malicious FTP accounts with shell injection payloads. Attackers can exploit the FTP account creation endpoint by injecting a reverse shell command that establishes a network connection to a specified listening host.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
ZesleCPZeslecp |
|
References
- ExploitDB-50233exploit
- ZesleCP Official Websiteproduct
- Exploit Demonstration Videoexploit
- VulnCheck Advisory: ZesleCP 3.1.9 - Remote Code Execution (RCE) (Authenticated)third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.