Vulnerability database

7 results

• Oct 8, 2026ProFTPD Improper Access Control VulnerabilityCVE-2015-3306 · Other software · ProFTPD · reported by MITREExploitedCritical 10

  ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

  Product

  ProFTPD

  On CISA’s list since

  Oct 8, 2026 (federal fix deadline Oct 11, 2026)

  What to do

  Attackers are using this now. Install ProFTPD’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloglists.fedoraproject.orglists.fedoraproject.org

• Mar 16, 2026Wing FTP Server Information Disclosure VulnerabilityCVE-2025-47813 · Other software · Wing FTP Server · reported by MITREExploitedMedium 4.3

  Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID cookie.

  Product

  Wing FTP Server

  On CISA’s list since

  Mar 16, 2026 (federal fix deadline Mar 30, 2026)

  What to do

  Attackers are using this now. Install Wing FTP Server’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.comrcesecurity.com

• Jul 22, 2025 CrushFTP Unprotected Alternate Channel VulnerabilityCVE-2025-54309 · Other software · CrushFTP · reported by MITREExploitedCritical 9

  CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.

  Product

  CrushFTP

  On CISA’s list since

  Jul 22, 2025 (federal fix deadline Aug 12, 2025)

  What to do

  Attackers are using this now. Install CrushFTP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogbleepingcomputer.comcrushftp.com

• Jul 14, 2025Wing FTP Server Improper Neutralization of Null Byte or NUL Character VulnerabilityCVE-2025-47812 · Other software · Wing FTP Server · reported by MITREExploitedCritical 10

  Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).

  Product

  Wing FTP Server

  On CISA’s list since

  Jul 14, 2025 (federal fix deadline Aug 4, 2025)

  What to do

  Attackers are using this now. Install Wing FTP Server’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogrcesecurity.comvicarius.io

• Apr 7, 2025CrushFTP Authentication Bypass VulnerabilityCVE-2025-31161 · Other software · CrushFTP · reported by MITREExploitedRansomwareCritical 9.8

  CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.

  Product

  CrushFTP

  On CISA’s list since

  Apr 7, 2025 (federal fix deadline Apr 28, 2025)

  What to do

  Attackers are using this now. Install CrushFTP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogcrushftp.comoutpost24.com

• Apr 24, 2024CrushFTP VFS Sandbox Escape VulnerabilityCVE-2024-4040 · Other software · CrushFTP · reported by 430a6cef-dc26-47e3-9fa8-52fb7f19644eExploitedCritical 9.8

  CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).

  Product

  CrushFTP

  On CISA’s list since

  Apr 24, 2024 (federal fix deadline May 1, 2024)

  What to do

  Attackers are using this now. Install CrushFTP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.combleepingcomputer.com

• Oct 5, 2023Progress WS_FTP Server Deserialization of Untrusted Data VulnerabilityCVE-2023-40044 · Other software · Progress · reported by security@progress.comExploitedRansomwareCritical 10

  Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.

  Product

  WS_FTP Server

  On CISA’s list since

  Oct 5, 2023 (federal fix deadline Oct 26, 2023)

  What to do

  Attackers are using this now. Install Progress’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comattackerkb.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.