[0day-rubbish] ZesleCP 3.1.21 Authenticated arbitrary file write to root RCE via cron (8.8)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-09-04 00:11 UTC
Importiert: 2026-09-04 00:47 UTC
Quelle-ID: full_disc
uid_hash: 4da552082757243cda051291f47f08b39c37d327d0cd5085c1e4f1ad8754d70e

Full Disclosure

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing a vulnerability in ZesleCP 3.1.21.

Type: Authenticated arbitrary file write to root RCE via cron (CWE-73)

CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Impact: Root file write and code execution on the hosting control panel host: all hosted accounts, databases,

credentials, and site files under attacker control.

Authentication: authenticated (requires valid session)

Full technical...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss