ZesleCP 3.1.9 - Remote Code Execution (RCE) (Authenticated) Severity High Date January 15, 2026 Affecting ZesleCP <= 3.1.9 Common Vulnerabilities and Exposures (CVE) CVE-2021-47794 Common Weakness Enumeration (CWE) CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVSS Score (Vector String) 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) References ExploitDB-50233 ZesleCP Official Website Exploit Demonstration Video Credit Numan Türlə Description ZesleCP 3.1.9 contains an authenticated remote code execution vulnerability that allows attackers to create malicious FTP accounts with shell injection payloads. Attackers can exploit the FTP account creation endpoint by injecting a reverse shell command that establishes a network connection to a specified listening host.