VDB
GCVE-110-OSM-2021-1
GCVE-110-OSM-2021-1
Advisory PublishedCVSS 9.6/10
Pure malware package with no legitimate functionality. Contains backdoor variant with C2 beacon capabilities for remote command execution and system reconnaissance.
Provides RCE via ?run=[command] URL parameter. Beacons to C2 at hxxp://insta.fr3on[.]info/ with system reconnaissance data: hostname, URL, server OS/architecture, and PHP execution user. C2 domain flagged as malicious on VirusTotal. Author identified as Ahmed Mardi (fr3on on GitHub), Egyptian PHP developer also responsible for laraveli/qr-code.
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | fr3on/neutron | All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), * (affected), * (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), * (affected), * (affected), * (affected), * (affected), All versions affected (affected), * (affected), * (affected), * (affected), All versions affected (affected), * (affected), All versions affected (affected), * (affected), * (affected), * (affected), All versions affected (affected), * (affected), * (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected) | — |
| unknown | all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), * (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), * (affected), all (affected), all (affected), all (affected), * (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), * (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), * (affected), all (affected), * (affected), all (affected), all (affected), all (affected), * (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), * (affected), * (affected), all (affected), * (affected), all (affected), * (affected), * (affected), * (affected), * (affected), all (affected), * (affected), * (affected), * (affected), all (affected), all (affected), * (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected) | — |
Browse GCVE Records
73,053 records in the GCVE database · Updated July 16, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.