CVE-2023-53886

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Xlight FTP Server 3.9.3.6 contains a stack buffer overflow vulnerability in the 'Execute Program' configuration that allows attackers to crash the application. Attackers can trigger the vulnerability by inserting 294 characters into the program execution configuration, causing a denial of service condition.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Xlightftpd	Xlight FTP Server	3.9.3.6

References

https://www.exploit-db.com/exploits/51665Exploit, Third Party Advisory
https://www.vulncheck.com/advisories/xlight-ftp-server-stack-buffer-overflow-vulnerability-via-execute-programThird Party Advisory
https://www.xlightftpd.com/Vendor Advisory
https://www.exploit-db.com/exploits/51665Exploit, Third Party Advisory

Timeline

Published: Dec 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-538875.4Zomplog 3.9 contains a cross-site scripting vulnerability that allows authenticated users to inject malicious scripts when creating new page CVE-2023-538888.8Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code thro CVE-2023-538897.2Perch CMS 3.2 contains a remote code execution vulnerability that allows authenticated administrators to upload arbitrary PHP files through CVE-2023-53897.5An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUO CVE-2023-538905.4Perch CMS 3.2 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedd CVE-2023-538915.4Blackcat CMS 1.4 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into page CVE-2023-538927.2Blackcat CMS 1.4 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files throu CVE-2023-538936.5Ateme TITAN File 3.9.12.4 contains an authenticated server-side request forgery vulnerability in the job callback URL parameter that allows CVE-2023-538949.8phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type comparison in password CVE-2023-538959.8PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorizati CVE-2023-538967.5D-Link DAP-1325 firmware version 1.01 contains a broken access control vulnerability that allows unauthenticated attackers to download devic CVE-2023-538975.4Rukovoditel 3.4.1 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scrip