deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-6207
Published: 2025-08-05
Description: The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_tempalte_import' function in all versions up to, and including, 3.9.28. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/wp-import-export-lite/trunk/includes/classes/class-wpie-common-action.php#L386; https://plugins.trac.wordpress.org/changeset/3323402/; https://www.wordfence.com/threat-intel/vulnerabilities/id/188eef67-de66-49c2-aa6c-2cf3b886ff66?source=cve
CVE: CVE-2025-8294
Published: 2025-08-05
Description: The Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3338968; https://wordpress.org/plugins/download-counter/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/9fcf7936-8a28-45b9-a9dc-fd7257a83a84?source=cve
CVE: CVE-2025-8295
Published: 2025-08-05
Description: The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/employee-directory/tags/4.5.1/includes/emd-form-builder-lite/emd-form-frontend.php; https://plugins.trac.wordpress.org/changeset/3336753/; https://wordpress.org/plugins/employee-directory/#developers
CVE: CVE-2025-8551
Published: 2025-08-05
Description: A vulnerability was found in atjiu pybbs up to 6.0.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/comment/list. The manipulation of the argument Username leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/atjiu/pybbs/commit/2fe4a51afbce0068c291bc1818bbc8f7f3b01a22; https://github.com/atjiu/pybbs/issues/204; https://github.com/atjiu/pybbs/issues/204#issue[PII_REDACTED]
CVE: CVE-2025-8552
Published: 2025-08-05
Description: A vulnerability classified as problematic has been found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /admin/tag/list. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/atjiu/pybbs/commit/2fe4a51afbce0068c291bc1818bbc8f7f3b01a22; https://github.com/atjiu/pybbs/issues/205; https://github.com/atjiu/pybbs/issues/205#issue[PII_REDACTED]
CVE: CVE-2025-8553
Published: 2025-08-05
Description: A vulnerability classified as problematic was found in atjiu pybbs up to 6.0.0. This vulnerability affects unknown code of the file /admin/sensitive_word/list. The manipulation of the argument word leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/atjiu/pybbs/commit/2fe4a51afbce0068c291bc1818bbc8f7f3b01a22; https://github.com/atjiu/pybbs/issues/206; https://github.com/atjiu/pybbs/issues/206#issue[PII_REDACTED]
CVE: CVE-2025-8554
Published: 2025-08-05
Description: A vulnerability, which was classified as problematic, has been found in atjiu pybbs up to 6.0.0. This issue affects some unknown processing of the file /admin/user/list. The manipulation of the argument Username leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/atjiu/pybbs/commit/2fe4a51afbce0068c291bc1818bbc8f7f3b01a22; https://github.com/atjiu/pybbs/issues/207; https://github.com/atjiu/pybbs/issues/207#issue[PII_REDACTED]
CVE: CVE-2025-8555
Published: 2025-08-05
Description: A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. Affected is an unknown function of the file /search. The manipulation of the argument keyword leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/atjiu/pybbs/commit/2fe4a51afbce0068c291bc1818bbc8f7f3b01a22; https://github.com/atjiu/pybbs/issues/208; https://github.com/atjiu/pybbs/issues/208#issue[PII_REDACTED]
CVE: CVE-2025-54948
Published: 2025-08-05
Description: A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-78
References: https://success.trendmicro.com/en-US/solution/KA-0020652; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54948
CVE: CVE-2025-54987
Published: 2025-08-05
Description: A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is essentially the same as CVE-2025-54948 but targets a different CPU architecture.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-78
References: https://success.trendmicro.com/en-US/solution/KA-0020652
CVE: CVE-2024-52890
Published: 2025-08-05
Description: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.03 could be susceptible to cross-site scripting due to no validation of URIs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-84
References: https://www.ibm.com/support/pages/node/7241392
CVE: CVE-2025-7025
Published: 2025-08-05
Description: A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat actor could execute code or disclose information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1731.html
CVE: CVE-2025-7032
Published: 2025-08-05
Description: A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat actor could execute code or disclose information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1731.html
CVE: CVE-2025-7033
Published: 2025-08-05
Description: A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat actor could execute code or disclose information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1731.html
CVE: CVE-2025-27931
Published: 2025-08-05
Description: An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Editor version 10.5.2.395.  By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2171; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2171
CVE: CVE-2025-29745
Published: 2025-08-05
Description: A vulnerability affecting the scanning module in Emsisoft Anti-Malware prior to 2024.12 allows attackers on a remote server to obtain Net-NTLMv2 hash information via a specially created A2S (Emsisoft Custom Scan) extension file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://packetstorm.news/files/id/188736/; https://www.youtube.com/watch?v=LxaYtxdJLM4
CVE: CVE-2025-2611
Published: 2025-08-05
Description: The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling.




Versions 7.4 and below are known to be vulnerable.
CWE: CWE-78
References: https://github.com/rapid7/metasploit-framework/pull/20446; https://www.vulncheck.com/advisories/ictbroadcast-unauthenticated-session-cookie-rce; https://www.vulncheck.com/blog/ictbroadcast-kev
CVE: CVE-2025-44964
Published: 2025-08-05
Description: A lack of SSL certificate validation in BlueStacks v5.20 allows attackers to execute a man-it-the-middle attack and obtain sensitive information.
CVSS Score: 3.9 (LOW)
CWE: CWE-295
References: http://bluestacks.com; https://claroty.com/team82/disclosure-dashboard/cve-2025-44964
CVE: CVE-2025-46958
Published: 2025-08-05
Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html
CVE: CVE-2025-47152
Published: 2025-08-05
Description: An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Co. Ltd PDF-XChange Editor 10.6.0.396.  By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2203; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2203
CVE: CVE-2025-50706
Published: 2025-08-05
Description: An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://xinyisleep.github.io/2024-04-24/Thinkphp5.1%E6%96%87%E4%BB%B6%E5%8C%85%E5%90%AB-CNVD-2024-29981; https://xinyisleep.github.io/CVE-2025-50706.md; https://xinyisleep.github.io/2024-04-24/Thinkphp5.1%E6%96%87%E4%BB%B6%E5%8C%85%E5%90%AB-CNVD-2024-29981
CVE: CVE-2025-50707
Published: 2025-08-05
Description: An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://xinyisleep.github.io/2024-07-15/Thinkphp3.%E6%96%87%E4%BB%B6%E5%8C%85%E5%90%AB-CNVD-2024-39045; https://xinyisleep.github.io/CVE-2025-50707.md; https://xinyisleep.github.io/2024-07-15/Thinkphp3.%E6%96%87%E4%BB%B6%E5%8C%85%E5%90%AB-CNVD-2024-39045
CVE: CVE-2025-54874
Published: 2025-08-05
Description: OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may lead to OOB heap memory write when the data stream p_stream is too short and p_image is not initialized.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-457
References: https://github.com/uclouvain/openjpeg/commit/f809b80c67717c152a5ad30bf06774f00da4fd2d; https://github.com/uclouvain/openjpeg/pull/1573; https://securitylab.github.com/advisories/GHSL-2025-057_OpenCV
CVE: CVE-2025-43979
Published: 2025-08-05
Description: An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN that allows authenticated attackers to execute arbitrary OS system commands with root privileges via crafted payloads to the xml_action.cgi?method= endpoint.
CVSS Score: 7.4 (HIGH)
CWE: CWE-78
References: https://github.com/actuator/cve/blob/main/Firstnum/CVE-2025-43979.txt; https://github.com/actuator/cve/tree/main/Firstnum
CVE: CVE-2025-46658
Published: 2025-08-05
Description: An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. There are verbose error messages.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-209
References: https://gist.github.com/Jowu73/005ca4f85b27fb272a4e62e373341fa5; https://www.4cstrategies.com/solutions/exonaut/
CVE: CVE-2025-43978
Published: 2025-08-05
Description: Jointelli 5G CPE 21H01 firmware JY_21H01_A3_v1.36 devices allow (blind) OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=set_WPS_pin and /ubus/?flag=netAppStar1 and /ubus/?flag=set_wifi_cfgs. This allows an authenticated attacker to execute arbitrary OS commands with root privileges via crafted inputs to the SSID, WPS, Traceroute, and Ping fields.
CVSS Score: 7.4 (HIGH)
CWE: CWE-78
References: https://github.com/actuator/cve/blob/main/Jointelli/CVE-2025-43978.txt; https://github.com/actuator/cve/tree/main/Jointelli; https://www.jointelli.com/cpe/5g-cpe-evo-4.html
CVE: CVE-2025-43980
Published: 2025-08-05
Description: An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN. They enable the SSH service by default with the credentials of root/admin. The GUI doesn't offer a way to disable the account.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/actuator/cve/blob/main/Firstnum/CVE-2025-43980.txt; https://github.com/actuator/cve/tree/main/Firstnum
CVE: CVE-2025-54253
Published: 2025-08-05
Description: Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-863
References: https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html; https://slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-forms/; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54253
CVE: CVE-2025-54254
Published: 2025-08-05
Description: Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the local file system, scope is changed. Exploitation of this issue does not require user interaction.
CVSS Score: 8.6 (HIGH)
CWE: CWE-611
References: https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html
CVE: CVE-2025-7674
Published: 2025-08-05
Description: Improper Input Validation vulnerability in Roche Diagnostics navify Monitoring allows an attacker to manipulate input data, which may lead to a denial of service (DoS) due to negatively impacting the server's performance. This vulnerability has no impact on data confidentiality or integrity.
This issue affects navify Monitoring before 1.08.00.
CWE: CWE-20
References: https://preview-owp.roche.com/content/dam/diagnostics/Blueprint/en/pdf/navify%20Monitoring%20-%20API%20Input%20Validation%20Vulnerability%20-%20Product%20Security%20Advisory.pdf
CVE: CVE-2025-8584
Published: 2025-08-05
Description: A vulnerability classified as problematic was found in libav up to 12.3. Affected by this vulnerability is the function av_buffer_unref of the file libavutil/buffer.c of the component AVI File Parser. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The bug was initially reported by the researcher to the wrong project. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476
References: https://drive.google.com/file/d/1OwDNHuTbZFNTDX9afmvez_old3oRC7dM/view?usp=sharing; https://trac.ffmpeg.org/ticket/11679; https://vuldb.com/?ctiid.318817
CVE: CVE-2025-8585
Published: 2025-08-05
Description: A vulnerability, which was classified as critical, has been found in libav up to 12.3. Affected by this issue is the function main of the file /avtools/avconv.c of the component DSS File Demuxer. The manipulation leads to double free. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The bug was initially reported by the researcher to the wrong project. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-415
References: https://drive.google.com/file/d/1I4VVXGys156UdeSTgya_GGxLZxwuxUPw/view?usp=sharing; https://trac.ffmpeg.org/ticket/11680; https://vuldb.com/?ctiid.318818
CVE: CVE-2025-50454
Published: 2025-08-05
Description: An Authentication Bypass vulnerability in Blue Access' Cobalt X1 thru 02.000.187 allows an unauthorized attacker to log into the application as an administrator without valid credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://blueaccesstech.com/collections/software/products/cobalt-x1-software; https://snakemacready.github.io/cve/2025/08/01/CVE-2025-50454.html
CVE: CVE-2025-50688
Published: 2025-08-05
Description: A command injection vulnerability exists in TwistedWeb (version 14.0.0) due to improper input sanitization in the file upload functionality. An attacker can exploit this vulnerability by sending a specially crafted HTTP PUT request to upload a malicious file (e.g., a reverse shell script). Once uploaded, the attacker can trigger the execution of arbitrary commands on the target system, allowing for remote code execution. This could lead to escalation of privileges depending on the privileges of the web server process. The attack does not require physical access and can be conducted remotely, posing a significant risk to the confidentiality and integrity of the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://medium.com/@Justinsecure/chained-rce-on-twistedweb-14-0-0-via-command-injection-and-unauthenticated-put-1aa657995b4e; https://twisted.org/documents/14.0.0/index.html
CVE: CVE-2025-51060
Published: 2025-08-05
Description: An issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the unvalidated parameters 0x9C402440 and 0x9C402444 as IoControlCodes to perform RDMSR and WRMSR, respectively. Through this process, the attacker can modify MSR_LSTAR and hook KiSystemCall64. Afterward, using Return-Oriented Programming (ROP), the attacker can manipulate the stack with pre-prepared gadgets, disable the SMAP flag in the CR4 register, and execute a user-mode syscall handler in the kernel context. It has not been confirmed whether this works on 32-bit Windows, but it functions on 64-bit Windows if the core isolation feature is either absent or disabled.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://cpuid.com; http://cpuzsys.com; https://github.com/ZiaLib/Zmsr
CVE: CVE-2025-51627
Published: 2025-08-05
Description: Incorrect access control in CaricaVerbale in Agenzia Impresa Eccobook v2.81.1 allows authenticated attackers with low-level access to escalate privileges to Administrator.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://agenziaimpresa.com; http://eccobook.com; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2025-51627%20%7C%20Eccobook.md
CVE: CVE-2025-51628
Published: 2025-08-05
Description: Insecure Direct Object Reference (IDOR) vulnerability in PdfHandler component in Agenzia Impresa Eccobook v2.81.1 and below allows unauthenticated attackers to read confidential documents via the DocumentoId parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: http://agenzia.com; http://eccobook.com; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2025-51628%20%7C%20Eccobook.md
CVE: CVE-2025-51857
Published: 2025-08-05
Description: The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://halo.com; https://gist.github.com/this1slwl/d[PII_REDACTED]19159607c14faebbbcf20; https://github.com/halo-dev/halo
CVE: CVE-2025-8586
Published: 2025-08-05
Description: A vulnerability, which was classified as problematic, was found in libav up to 12.3. This affects the function ff_seek_frame_binary of the file /libavformat/utils.c of the component MPEG File Parser. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The bug was initially reported by the researcher to the wrong project. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476
References: https://drive.google.com/file/d/1CX1GZUyJVzyDDGLVa8FG58XUt_30kHKT/view?usp=sharing; https://trac.ffmpeg.org/ticket/11681; https://vuldb.com/?ctiid.318819
CVE: CVE-2025-45512
Published: 2025-08-05
Description: A lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U-Boot) v1.1.3 allows attackers to install crafted firmware files, leading to arbitrary code execution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://gist.github.com/AzhariRamadhan/a5c9644861f46b1eadb1f2a15c7950fe; https://github.com/AzhariRamadhan/uboot-cve
CVE: CVE-2012-10023
Published: 2025-08-05
Description: A stack-based buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0. The server fails to properly validate input passed to the USER command, allowing remote attackers to overwrite memory and potentially execute arbitrary code. The flaw is triggered by sending an overly long username string, which overflows the buffer allocated for user authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://my.saintcorporation.com/cgi-bin/exploit_info/freefloat_ftp_server_user_cmd; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/freefloatftp_user.rb; https://web.archive.org/web/[PII_REDACTED]0029/http://secunia.com/advisories/42465/