CVE-2021-4466

IPCop versions up to and including 2.1.9 contain an authenticated remote code execution vulnerability within the web-based administration interface. The email configuration component inserts user-controlled values, including the EMAIL_PW parameter, directly into system-level operations without proper input sanitation. By modifying the email password field to include shell metacharacters and issuing a save-and-test-mail action, an authenticated attacker can execute arbitrary operating system commands with the privileges of the web interface, resulting in full system compromise.

• CWE-78

• https://sourceforge.net/projects/ipcop/
• https://www.exploit-db.com/exploits/50183
• https://www.ipcop.org/
• https://www.vulncheck.com/advisories/ipcop-authenticated-rce

Published

Nov 14, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-44651Zoho ManageEngine CloudSecurityPlus before Build 4117 allows…8.8
• CVE-2021-44652Zoho ManageEngine O365 Manager Plus before Build 4416 allows…7.8
• CVE-2021-44653Online Magazine Management System 1.0 contains a SQL injecti…9.8
• CVE-2021-44655Online Pre-owned/Used Car Showroom Management System 1.0 con…9.8
• CVE-2021-44657In StackStorm versions prior to 3.6.0, the jinja interpreter…8.8
• CVE-2021-44659Adding a new pipeline in GoCD server version 21.3.0 has a fu…9.8
• CVE-2021-44662A Site Scripting (XSS) vulnerability exists in the Xerte Pro…6.1
• CVE-2021-44663A Remote Code Execution (RCE) vulnerability exists in the Xe…9.8
• CVE-2021-44664An Authenticated Remote Code Exection (RCE) vulnerability ex…8.8
• CVE-2021-44665A Directory Traversal vulnerability exists in the Xerte Proj…6.5
• CVE-2021-44667A Cross Site Scripting (XSS) vulnerability exists in Nacos 2…6.1
• CVE-2021-4467Positive Technologies MaxPatrol 8 and XSpider contain a remo…8.7