Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
820 results · page 2 of 17
Dec 12, 2025PCMan FTP Server 2.0 contains a buffer overflow vulnerability in the 'pwd' command that allows remote attackers to execute arbitrary code.CVE-2024-58299 · Other software · PCMan · reported by VulnCheckCritical 9.3
PCMan FTP Server 2.0 contains a buffer overflow vulnerability in the 'pwd' command that allows remote attackers to execute arbitrary code. Attackers can send a specially crafted payload during the FTP login process to overwrite memory and potentially gain system access.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netexploit-db.com
Nov 17, 2025CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2025-55059 · Other software · Rumpus · reported by cna@cyber.gov.ilMedium 4.8
CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025CWE-20 Improper Input ValidationCVE-2025-55058 · Other software · Rumpus · reported by cna@cyber.gov.ilMedium 4.5
CWE-20 Improper Input Validation
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025Multiple CWE-352 Cross-Site Request Forgery (CSRF)CVE-2025-55057 · Other software · Rumpus · reported by cna@cyber.gov.ilMedium 4.5
Multiple CWE-352 Cross-Site Request Forgery (CSRF)
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025Multiple CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2025-55056 · Other software · Rumpus · reported by cna@cyber.gov.ilMedium 4.8
Multiple CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2025-55055 · Other software · Rumpus · reported by cna@cyber.gov.ilMedium 6.8
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2025Potential stack buffer overwrite on the SFTP server side when receiving a malicious packet that has a handle size larger than the system handle or file descriptCVE-2025-11624 · Other software · wolfSSH · reported by facts@wolfssl.comLow 1.8
Potential stack buffer overwrite on the SFTP server side when receiving a malicious packet that has a handle size larger than the system handle or file descriptor size, but smaller than max handle size allowed.
- Product
- wolfSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2025The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304.CVE-2025-10639 · Other software · EfficientLab · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.8
The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network access to this port can use weak hardcoded credentials to login to the FTP server and modify or read data, log files and gain remote code execution as NT Authority\SYSTEM on the server by exchanging accessible service binaries in the WorkExaminer installation directory (e.g. "C:\Program File (x86)\Work Examiner Professional Server").
- Product
- WorkExaminer Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comseclists.org
Oct 9, 2025An Authentication Bypass by Primary Weakness in the FTP server of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to get limited reCVE-2025-59980 · Network & remote access · Juniper Networks · reported by sirt@juniper.netMedium 6.9
An Authentication Bypass by Primary Weakness in the FTP server of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to get limited read-write access to files on the device. When the FTP server is enabled and a user named "ftp" or "anonymous" is configured, that user can login without providing the configured password and then has read-write access to their home directory. This issue affects Junos OS: * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2.
- Product
- Junos OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.net
Aug 21, 2025EasyFTP Server 1.7.0.11 and earlier contains a stack-based buffer overflow vulnerability in its HTTP interface.CVE-2010-20113 · Other software · KMiNT21 Software · reported by VulnCheckCritical 9.3
EasyFTP Server 1.7.0.11 and earlier contains a stack-based buffer overflow vulnerability in its HTTP interface. When processing a GET request to list.html, the server fails to properly validate the length of the path parameter. Supplying an excessively long value causes a buffer overflow on the stack, potentially corrupting control flow structures. The vulnerability is exposed through the embedded web server and does not require authentication due to default anonymous access. The issue was resolved in version 1.7.0.12, after which the product was renamed to UplusFtp.
- Product
- EasyFTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comexploit-db.com
Aug 21, 2025EasyFTP Server versions up to 1.7.0.11 contain a stack-based buffer overflow vulnerability in the FTP command parser.CVE-2010-20121 · Other software · KMiNT21 Software · reported by VulnCheckCritical 9.3
EasyFTP Server versions up to 1.7.0.11 contain a stack-based buffer overflow vulnerability in the FTP command parser. When processing the CWD (Change Working Directory) command, the server fails to properly validate the length of the input string, allowing attackers to overwrite memory on the stack. This flaw enables remote code execution without authentication, as EasyFTP allows anonymous access by default. The vulnerability was resolved in version 1.7.0.12, after which the product was renamed “UplusFtp.”
- Product
- EasyFTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpaulmakowski.wordpress.comraw.githubusercontent.com
Aug 20, 2025Solar FTP Server fails to properly handle format strings passed to the USER command.CVE-2011-10029 · Other software · Flexbyte Software · reported by VulnCheckHigh 8.7
Solar FTP Server fails to properly handle format strings passed to the USER command. When a specially crafted string containing format specifiers is sent, the server crashes due to a read access violation in the __output_1() function of sfsservice.exe. This results in a denial of service (DoS) condition.
- Product
- Solar FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comweb.archive.org
Aug 20, 2025FileWrangler <= 5.30 suffers from a stack-based buffer overflow vulnerability when parsing directory listings from an FTP server.CVE-2010-20045 · Other software · CursorArts · reported by VulnCheckHigh 8.5
FileWrangler <= 5.30 suffers from a stack-based buffer overflow vulnerability when parsing directory listings from an FTP server. A malicious server can send an overlong folder name in response to a LIST command, triggering memory corruption during client-side rendering. Exploitation requires passive user interaction—simply connecting to the server—without further input. Successful exploitation may lead to arbitrary code execution.
- Product
- FileWrangler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcursorarts.comraw.githubusercontent.com
Aug 13, 2025ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command.CVE-2012-10055 · Other software · ComSndFTP · reported by VulnCheckCritical 9.3
ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending a specially crafted username containing format specifiers, a remote attacker can overwrite a hardcoded function pointer in memory (specifically WSACleanup from Ws2_32.dll). This allows the attacker to redirect execution flow and bypass DEP protections using a ROP chain, ultimately leading to arbitrary code execution. The vulnerability is exploitable without authentication and affects default configurations.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comweb.archive.org
Aug 5, 2025Turbo FTP Server versions 1.30.823 and 1.30.826 contain a buffer overflow vulnerability in the handling of the PORT command.CVE-2012-10035 · Other software · TurboSoft, Inc. · reported by VulnCheckCritical 10
Turbo FTP Server versions 1.30.823 and 1.30.826 contain a buffer overflow vulnerability in the handling of the PORT command. By sending a specially crafted payload, an unauthenticated remote attacker can overwrite memory structures and execute arbitrary code with SYSTEM privileges.
- Product
- TurboFTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comexploit-db.com
Aug 5, 2025FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directoriCVE-2012-10030 · Other software · FreeFloat · reported by VulnCheckCritical 9.3
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directories. The server accepts empty credentials, defaults user access to the root of the C:\ drive, and imposes no restrictions on file type or destination path. These conditions enable attackers to upload executable payloads and .mof files to locations such as system32 and wbem\mof, where Windows Management Instrumentation (WMI) automatically processes and executes them. This results in remote code execution with SYSTEM-level privileges, without requiring user interaction.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchive.orgraw.githubusercontent.com
Aug 5, 2025A stack-based buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0.CVE-2012-10023 · Other software · FreeFloat · reported by VulnCheckMedium 6.9
A stack-based buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0. The server fails to properly validate input passed to the USER command, allowing remote attackers to overwrite memory and potentially execute arbitrary code. The flaw is triggered by sending an overly long username string, which overflows the buffer allocated for user authentication.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmy.saintcorporation.comraw.githubusercontent.com
Jul 25, 2025A flaw was found in the SFTP server message decoding logic of libssh.CVE-2025-5449 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jul 15, 2025A directory traversal vulnerability exists in ColoradoFTP Server ≤ 1.3 Build 8 for Windows, allowing unauthenticated attackers to read or write arbitrary files CVE-2025-34110 · Other software · ColoradoFTP · reported by VulnCheckCritical 9.3
A directory traversal vulnerability exists in ColoradoFTP Server ≤ 1.3 Build 8 for Windows, allowing unauthenticated attackers to read or write arbitrary files outside the configured FTP root directory. The flaw is due to insufficient sanitation of user-supplied file paths in the FTP GET and PUT command handlers. Exploitation is possible by submitting traversal sequences during FTP operations, enabling access to system-sensitive files. This issue affects only the Windows version of ColoradoFTP.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgraw.githubusercontent.com
Jul 10, 2025Wing FTP Server Information Disclosure VulnerabilityCVE-2025-47813 · Other software · Wing FTP Server · reported by MITREExploitedMedium 4.3
Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID cookie.
- Product
- Wing FTP Server
- On CISA’s list since
- Mar 16, 2026 (federal fix deadline Mar 30, 2026)
- What to do
- Attackers are using this now. Install Wing FTP Server’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comrcesecurity.com
Jul 10, 2025Wing FTP Server Improper Neutralization of Null Byte or NUL Character VulnerabilityCVE-2025-47812 · Other software · Wing FTP Server · reported by MITREExploitedCritical 10
Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).
- Product
- Wing FTP Server
- On CISA’s list since
- Jul 14, 2025 (federal fix deadline Aug 4, 2025)
- What to do
- Attackers are using this now. Install Wing FTP Server’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogrcesecurity.comvicarius.io
Jul 10, 2025In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default.CVE-2025-47811 · Other software · wftpserver · reported by MITREMedium 4.1
In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application itself offers several legitimate ways to execute arbitrary system commands (i.e., through the web console or the task scheduler), and they are automatically executed in the highest possible privilege context. Because administrative users of the web interface are not necessarily also system administrators, one might argue that this is a privilege escalation. (If a privileged application role is not available to an attacker, CVE-2025-47812 can be leveraged.) NOTE: the vendor reportedly considers this behavior "fine to keep."
- Product
- Wing FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrcesecurity.comwftpserver.com
Jul 10, 2025Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary linCVE-2025-27889 · Other software · wftpserver · reported by MITRELow 3.4
Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker.
- Product
- Wing FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrcesecurity.com
Jun 12, 2025The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the CVE-2025-49195 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server.
- Product
- SICK Media Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A vulnerability was found in FreeFloat FTP Server 1.0.CVE-2025-5667 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability was found in FreeFloat FTP Server 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the component REIN Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A vulnerability was found in FreeFloat FTP Server 1.0.CVE-2025-5666 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability was found in FreeFloat FTP Server 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component XMKD Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A vulnerability was found in FreeFloat FTP Server 1.0.CVE-2025-5665 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. Affected is an unknown function of the component XCWD Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical.CVE-2025-5664 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. This issue affects some unknown processing of the component RESTART Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7.CVE-2025-5637 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component SYSTEM Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7.CVE-2025-5636 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component SET Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A vulnerability classified as critical was found in PCMan FTP Server 2.0.7.CVE-2025-5635 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component PLS Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7.CVE-2025-5634 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component NOOP Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025A vulnerability was found in FreeFloat FTP Server 1.0.CVE-2025-5596 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. Affected is an unknown function of the component REGET Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical.CVE-2025-5595 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. This issue affects some unknown processing of the component PROGRESS Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical.CVE-2025-5594 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. This vulnerability affects unknown code of the component SET Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0.CVE-2025-5593 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component HOST Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0.CVE-2025-5592 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the component PASSIVE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025A vulnerability was found in FreeFloat FTP Server 1.0.CVE-2025-5551 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. This affects an unknown part of the component SYSTEM Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical.CVE-2025-5550 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this issue is some unknown functionality of the component PBSZ Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical.CVE-2025-5549 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component PASV Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0.CVE-2025-5548 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component NOOP Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0.CVE-2025-5547 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. This issue affects some unknown processing of the component CDUP Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025A vulnerability was found in FreeFloat FTP Server 1.0.CVE-2025-5357 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability was found in FreeFloat FTP Server 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component PWD Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025A vulnerability was found in FreeFloat FTP Server 1.0.CVE-2025-5356 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. Affected is an unknown function of the component BYE Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical.CVE-2025-5331 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. This vulnerability affects unknown code of the component NLST Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0.CVE-2025-5330 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component RETR Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2025A vulnerability classified as critical was found in FreeFloat FTP Server 1.0.0.CVE-2025-5295 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in FreeFloat FTP Server 1.0.0. This vulnerability affects unknown code of the component PORT Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in FreeFloat FTP Server 1.0.0.CVE-2025-5221 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability was found in FreeFloat FTP Server 1.0.0. It has been classified as critical. This affects an unknown part of the component QUOTE Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in FreeFloat FTP Server 1.0.0 and classified as critical.CVE-2025-5220 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability was found in FreeFloat FTP Server 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the component GET Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability has been found in FreeFloat FTP Server 1.0.0 and classified as critical.CVE-2025-5219 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability has been found in FreeFloat FTP Server 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component ASCII Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.