Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
99Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actcvss 10epss 53%
da publicação à arma0 dias
Publicada no NVD20 de jun.
1ª PoC20 de jun.
metasploit19 de jun.
VulnCheck19 de jun.
probabilidade de exploração
53%top 1% das CVEs
exploração observada
simVulnCheck
61 exploit(s) público(s)
Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
pterodactyl · panelPoCs públicas encontradas — 61
exploitdbwww.exploit-db.com/exploits/52341não verificadogithubgithub.com/YoyoChaud/CVE-2025-49132★ 25githubgithub.com/Zen-kun04/CVE-2025-49132★ 17githubgithub.com/malw0re/CVE-2025-49132-Mods★ 12githubgithub.com/63square/CVE-2025-49132★ 5githubgithub.com/popyue/CVE-2025-49132★ 4githubgithub.com/qiaojojo/CVE-2025-49132_poc★ 4githubgithub.com/0xtensho/CVE-2025-49132-poc★ 3githubgithub.com/GRodolphe/CVE-2025-49132_poc★ 3githubgithub.com/str1keboo/CVE-2025-49132★ 3githubgithub.com/dollarboysushil/CVE-2025-49132-Pterodactyl-Panel-Unauthenticated-Remote-Code-Execution-RCE-★ 3githubgithub.com/rippsec/CVE-2025-49132-PHP-PEAR★ 3githubgithub.com/pxxdrobits/CVE-2025-49132★ 2githubgithub.com/symphony2colour/HTB-Pterodactyl-RCE-CVE-2025-49132★ 1githubgithub.com/matesz44/CVE-2025-49132★ 1githubgithub.com/thealchimist86/CVE-2025-49132-Pterodactyl-Panel-RCE★ 1githubgithub.com/Pwndalf/CVE-2025-49132-PoC★ 1githubgithub.com/ramzihafiz/CVE-2025-49132★ 1githubgithub.com/vimmwy/CVE-2025-49132★ 1githubgithub.com/Ahmedf000/CVE-2025-49132_HTB_SEASON10★ 0githubgithub.com/typicalsmc/CVE-2025-49132-PoC★ 0githubgithub.com/melonlonmeo/CVE-2025-49132★ 0githubgithub.com/WebSafety-2tina/CVE-2025-49132★ 0githubgithub.com/kerburenthusiasm/CVE-2025-49132-PoC★ 0githubgithub.com/karimelsheikh1/HTB-Pterodactyl-Writeup★ 0githubgithub.com/scroollocker/CVE-2025-49132★ 0githubgithub.com/nik123-py/CVE-2025-49132_HTB_SEASON10★ 0githubgithub.com/4nuxd/CVE-2025-49132★ 0githubgithub.com/V0idW1re/HTB-Pterodactyl-Writeup★ 0githubgithub.com/yurahshell/CVE-2025-49132★ 0vulncheckvulncheck.com/xdb/62fba677a15cnão verificadovulncheckvulncheck.com/xdb/b5e1a9cf356anão verificadovulncheckvulncheck.com/xdb/3d29769012ddnão verificadovulncheckvulncheck.com/xdb/c2c106ebd6e0não verificadovulncheckvulncheck.com/xdb/9a716fc13bb0não verificadovulncheckvulncheck.com/xdb/27478c3c78a9não verificadovulncheckvulncheck.com/xdb/4a43ddc95aa5não verificadovulncheckvulncheck.com/xdb/1ee587c76421não verificadovulncheckvulncheck.com/xdb/567dfdc818e6não verificadovulncheckvulncheck.com/xdb/1d225955a5benão verificadovulncheckvulncheck.com/xdb/bc8e85534e70não verificadovulncheckvulncheck.com/xdb/257322a955ednão verificadovulncheckvulncheck.com/xdb/ecb27047a9f1não verificadovulncheckvulncheck.com/xdb/ee89cc59e31cnão verificadovulncheckvulncheck.com/xdb/20f9996dd19bnão verificadovulncheckvulncheck.com/xdb/9ee1016338d0não verificadovulncheckvulncheck.com/xdb/d14488c76804não verificadovulncheckvulncheck.com/xdb/a46e88978d3fnão verificadovulncheckvulncheck.com/xdb/c53be3f0a3ecnão verificadovulncheckvulncheck.com/xdb/86f1349d3268não verificadovulncheckvulncheck.com/xdb/1061c622231enão verificadovulncheckvulncheck.com/xdb/78762d166ba2não verificadovulncheckvulncheck.com/xdb/4524ceeb6459não verificadovulncheckvulncheck.com/xdb/23db4ac0642cnão verificadovulncheckvulncheck.com/xdb/27db0ff02fafnão verificadovulncheckvulncheck.com/xdb/7eafd91c79fdnão verificadovulncheckvulncheck.com/xdb/4487fa27f075não verificadovulncheckvulncheck.com/xdb/5dffb08c1813não verificadovulncheckvulncheck.com/xdb/9cd3b1d94ac5não verificadovulncheckvulncheck.com/xdb/3092ae31c466não verificadovulncheckvulncheck.com/xdb/571b13ffff02não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.