Vulnerability · Published Jan 15, 2026 · Assigned by VulnCheck
CVE-2021-47794ZesleCP 3.1.9 - Remote Code Execution (RCE) (Authenticated)
High 8.8
In plain English
A high-severity OS command injection in ZesleCP from Zeslecp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.0%top 36.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ZesleCP 3.1.9 contains an authenticated remote code execution vulnerability that allows attackers to create malicious FTP accounts with shell injection payloads. Attackers can exploit the FTP account creation endpoint by injecting a reverse shell command that establishes a network connection to a specified listening host.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-50233 exploit
- ZesleCP Official Website product
- Exploit Demonstration Video exploit
- VulnCheck Advisory: ZesleCP 3.1.9 - Remote Code Execution (RCE) (Authenticated) third-party-advisory