CVE-2019-25321

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

FTP Navigator 8.03 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) registers. Attackers can craft a malicious payload that triggers a buffer overflow when pasted into the Custom Command textbox, enabling remote code execution and launching the calculator as proof of concept.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Vendor	Product	Versions
Softpedia	FTP Navigator	8.03

References

http://www.internet-soft.com/Product
https://www.exploit-db.com/exploits/47794Exploit, VDB Entry
https://www.exploit-db.com/exploits/47812Exploit, Third Party Advisory, VDB Entry
https://www.vulncheck.com/advisories/ftp-navigator-stack-overflow-sehThird Party Advisory

Timeline

Published: Feb 12, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-253227.5Heatmiser Netmonitor 3.03 contains a hardcoded credentials vulnerability in the networkSetup.htm page with predictable admin login credentia CVE-2019-253236.1Heatmiser Netmonitor v3.03 contains an HTML injection vulnerability in the outputSetup.htm page that allows attackers to inject malicious HT CVE-2019-253246.1RICOH Web Image Monitor 1.09 contains an HTML injection vulnerability in the address configuration CGI script that allows attackers to injec CVE-2019-253258.2Thrive Smart Home 1.1 contains an SQL injection vulnerability in the checklogin.php endpoint that allows unauthenticated attackers to bypass CVE-2019-253265.5ipPulse 1.92 contains a denial of service vulnerability that allows local attackers to crash the application by providing an oversized input CVE-2019-253279.8Prime95 version 29.8 build 6 contains a buffer overflow vulnerability in the user ID input field that allows remote attackers to execute arb CVE-2019-253287.5XnConvert 1.82 contains a denial of service vulnerability in its registration code input field that allows attackers to crash the applicatio CVE-2019-253297.5FTP Navigator 8.03 contains a denial of service vulnerability that allows attackers to crash the application by overwriting Structured Excep CVE-2019-25336.5Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges). Supported versions that are affe CVE-2019-253307.5SurfOffline Professional 2.2.0.103 contains a structured exception handler (SEH) overflow vulnerability that allows attackers to crash the a CVE-2019-253318.4AVS Audio Converter 9.1 contains a local buffer overflow vulnerability that allows local attackers to overwrite CPU registers by manipulatin CVE-2019-253328.4FTP Commander Pro 8.03 contains a local stack overflow vulnerability that allows attackers to execute arbitrary code by overwriting the EIP