Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
156 results · page 1 of 4
Oct 23, 2026CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path.CVE-2025-30043 · Other software · CGM · reported by cvd@cert.plHigh 7.1
CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and download those documents. This issue was fixed in version 2026.MS3
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A vulnerability was found in PCMan FTP Server up to 2.0.7.CVE-2016-15060 · Other software · PCMan · reported by VulDBMedium 5.5
A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler. The manipulation results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office doCVE-2026-108750 · Other software · OpenDocMan · reported by VulnCheckMedium 5.3
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers and degrading availability.
- Product
- OpenDocMan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 - The Joomla extension EDocman is vulnerable to an unauthenticated SQCVE-2026-57832 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 - The Joomla extension EDocman is vulnerable to an unauthenticated SQL injection.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjoomdonation.commysites.guru
Jul 8, 2026FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callCVE-2026-56297 · Other software · FreeRDP · reported by VulnCheckHigh 8.3
FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
May 22, 2026An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0.CVE-2026-48700 · Other software · LXQt · reported by MITRECritical 9.3
An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. When a regular file's path is passed as a URI in an org.freedesktop.FileManager1.ShowFolders D-Bus method call, PCManFM-Qt delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution or circumvent network namespace restrictions. NOTE: those outcomes are potentially unwanted by most users; however, the behavior of the product does comply with the applicable specification, and a simplistic solution (ensuring that the URI does not name a regular file) may have adverse consequences for I/O.
- Product
- PCManFM-Qt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
Apr 21, 2026PcManager is affected by type privilege bypass, successful exploitation of this vulnerability may affect service availabilityCVE-2026-31369 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Low 3.2
PcManager is affected by type privilege bypass, successful exploitation of this vulnerability may affect service availability
- Product
- PcManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2026OpenDocMan 1.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the CVE-2019-25684 · Other software · opendocman · reported by VulnCheckHigh 8.8
OpenDocMan 1.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'where' parameter. Attackers can send GET requests to search.php with malicious SQL payloads in the 'where' parameter to extract sensitive database information.
- Product
- OpenDocMan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netexploit-db.com
Feb 23, 2026A privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to execute programs with elCVE-2025-63946 · Other software · Tencent · reported by MITREHigh 7.4
A privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition.
- Product
- Pcmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2025PCMan FTP Server 2.0 contains a buffer overflow vulnerability in the 'pwd' command that allows remote attackers to execute arbitrary code.CVE-2024-58299 · Other software · PCMan · reported by VulnCheckCritical 9.3
PCMan FTP Server 2.0 contains a buffer overflow vulnerability in the 'pwd' command that allows remote attackers to execute arbitrary code. Attackers can send a specially crafted payload during the FTP login process to overwrite memory and potentially gain system access.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netexploit-db.com
Dec 2, 2025User Enumeration Vulnerability in TCMAN GIM v11 version 20250304.CVE-2025-41015 · Other software · TCMAN · reported by cve-coordination@incibe.esMedium 6.9
User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetUserQuestionAndAnswer' in '/WS/PDAWebService.asmx'.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025User Enumeration Vulnerability in TCMAN GIM v11 version 20250304.CVE-2025-41014 · Other software · TCMAN · reported by cve-coordination@incibe.esMedium 6.9
User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetLastDatePasswordChange' in '/WS/PDAWebService.asmx'.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025SQL injection vulnerability in TCMAN GIM v11 in version 20250304.CVE-2025-41013 · Other software · TCMAN · reported by cve-coordination@incibe.esHigh 8.7
SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a GET request using the 'idmant' parameter in '/PC/frmEPIS.aspx'.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025Unauthorized access vulnerability in TCMAN GIM v11 version 20250304.CVE-2025-41012 · Other software · TCMAN · reported by cve-coordination@incibe.esHigh 8.7
Unauthorized access vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system by using the 'pda:userId' and 'pda:newPassword' parameters with 'soapaction UnlockUser’ in '/WS/PDAWebService.asmx'.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025An arbitrary file upload vulnerability in the component /controller/PicManager.php of FoxCMS v1.2.6 allows attackers to execute arbitrary code via uploading a cCVE-2025-51650 · Other software · Qianfox · reported by MITREMedium 5.6
An arbitrary file upload vulnerability in the component /controller/PicManager.php of FoxCMS v1.2.6 allows attackers to execute arbitrary code via uploading a crafted template file.
- Product
- Foxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025Incorrect authorization vulnerability in TCMAN's GIM v11.CVE-2025-40670 · Other software · TCMAN · reported by cve-coordination@incibe.esHigh 7.1
Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by sending a POST request to /PC/frmGestionUser.aspx/updateUser.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025Incorrect authorization vulnerability in TCMAN's GIM v11.CVE-2025-40669 · Other software · TCMAN · reported by cve-coordination@incibe.esHigh 7.1
Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application's users, including the user himself by sending a POST request to /PC/Options.aspx?Command=2&Page=-1.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025Incorrect authorization vulnerability in TCMAN's GIM v11.CVE-2025-40668 · Other software · TCMAN · reported by cve-coordination@incibe.esHigh 7.1
Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other users through a POST request using the parameters idUser, PasswordActual, PasswordNew and PasswordNewRepeat in /PC/WebService.aspx/validateChangePassword%C3%B1a. To exploit the vulnerability the PasswordActual parameter must be empty.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7.CVE-2025-5637 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component SYSTEM Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7.CVE-2025-5636 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component SET Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A vulnerability classified as critical was found in PCMan FTP Server 2.0.7.CVE-2025-5635 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component PLS Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7.CVE-2025-5634 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component NOOP Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical.CVE-2025-5331 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. This vulnerability affects unknown code of the component NLST Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025Missing authorization vulnerability in TCMAN's GIM v11.CVE-2025-40667 · Other software · TCMAN · reported by cve-coordination@incibe.esHigh 8.7
Missing authorization vulnerability in TCMAN's GIM v11. This allows an authenticated attacker to access any functionality of the application even when they are not available through the user interface. To exploit the vulnerability the attacker must modify the HTTP code of the response from ‘302 Found’ to ‘200 OK’, as well as the hidden fields hdnReadOnly and hdnUserLogin.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11.CVE-2025-40666 · Other software · TCMAN · reported by cve-coordination@incibe.esHigh 8.7
Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID parameter in/GIMWeb/PC/frmPreventivosList.aspx.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11.CVE-2025-40665 · Other software · TCMAN · reported by cve-coordination@incibe.esHigh 8.7
Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID parameter in /GIMWeb/PC/frmCorrectivosList.aspx.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025Missing authentication vulnerability in TCMAN GIM v11.CVE-2025-40664 · Other software · TCMAN · reported by cve-coordination@incibe.esCritical 9.3
Missing authentication vulnerability in TCMAN GIM v11. This allows an unauthenticated attacker to access the resources /frmGestionUser.aspx/GetData, /frmGestionUser.aspx/updateUser and /frmGestionUser.aspx/DeleteUser.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2025A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7.CVE-2025-4871 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component REST Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025Unrestricted file upload in TCMAN's GIM v11.CVE-2025-40625 · Other software · TCMAN · reported by cve-coordination@incibe.esCritical 9.3
Unrestricted file upload in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to upload any file within the server, even a malicious file to obtain a Remote Code Execution (RCE).
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025SQL injection in TCMAN's GIM v11.CVE-2025-40624 · Other software · TCMAN · reported by cve-coordination@incibe.esCritical 9.3
SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ and “email” parameters of the ‘updatePassword’ endpoint.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025SQL injection in TCMAN's GIM v11.CVE-2025-40623 · Other software · TCMAN · reported by cve-coordination@incibe.esCritical 9.3
SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘Sender’ and “email” parameters of the ‘createNotificationAndroid’ endpoint.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025SQL injection in TCMAN's GIM v11.CVE-2025-40622 · Other software · TCMAN · reported by cve-coordination@incibe.esCritical 9.3
SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘username’ parameter of the ‘GetLastDatePasswordChange’ endpoint.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025SQL injection in TCMAN's GIM v11.CVE-2025-40621 · Other software · TCMAN · reported by cve-coordination@incibe.esCritical 9.3
SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ parameter of the ‘ValidateUserAndGetData’ endpoint.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025SQL injection in TCMAN's GIM v11.CVE-2025-40620 · Other software · TCMAN · reported by cve-coordination@incibe.esCritical 9.3
SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ parameter of the ‘ValidateUserAndWS’ endpoint.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7.CVE-2025-4290 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component SMNT Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025A vulnerability classified as critical was found in PCMan FTP Server 2.0.7.CVE-2025-4289 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component RNTO Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7.CVE-2025-4288 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RNFR Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2025A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7.CVE-2025-4255 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RMD Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2025A vulnerability was found in PCMan FTP Server 2.0.7.CVE-2025-4254 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component LIST Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2025A vulnerability was found in PCMan FTP Server 2.0.7.CVE-2025-4253 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component HASH Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2025A vulnerability was found in PCMan FTP Server 2.0.7.CVE-2025-4252 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. Affected is an unknown function of the component APPEND Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2025A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical.CVE-2025-4251 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. This issue affects some unknown processing of the component RMDIR Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2025A vulnerability was found in PCMan FTP Server 2.0.7.CVE-2025-4240 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. This issue affects some unknown processing of the component LCD Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2025A vulnerability was found in PCMan FTP Server 2.0.7.CVE-2025-4239 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. This vulnerability affects unknown code of the component TYPE Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2025A vulnerability was found in PCMan FTP Server 2.0.7.CVE-2025-4238 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. This affects an unknown part of the component MGET Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2025A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical.CVE-2025-4237 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component MDELETE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2025A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical.CVE-2025-4236 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the component MDIR Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025A vulnerability classified as critical was found in PCMan FTP Server 2.0.7.CVE-2025-4184 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component QUOTE Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7.CVE-2025-4183 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RECV Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025A vulnerability was found in PCMan FTP Server 2.0.7.CVE-2025-4182 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component BELL Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.