CVE-2025-4254

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component LIST Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
PCMan	FTP Server	2.0.7

References

https://fitoxs.com/exploit/exploit-e4fd898014889301fef4607c9a2641c3db234bb5a057a22952bfb70e70b4c279.txtExploit
https://vuldb.com/?ctiid.307358Permissions Required
https://vuldb.com/?id.307358Third Party Advisory, VDB Entry
https://vuldb.com/?submit.561611Exploit, Third Party Advisory, VDB Entry

Timeline

Published: May 5, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-42559.8A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RMD Command H CVE-2025-42565.4A vulnerability classified as problematic was found in SeaCMS 13.2. This vulnerability affects unknown code of the file /admin_paylog.php. T CVE-2025-42576.1A vulnerability, which was classified as problematic, has been found in SeaCMS 13.2. This issue affects some unknown processing of the file CVE-2025-42588.8A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu up to 4.2.0. Affected is the function Upload of the f CVE-2025-42599.8A vulnerability has been found in newbee-mall 1.0 and classified as critical. Affected by this vulnerability is the function Upload of the f CVE-2025-425987.8Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a l CVE-2025-425999.8Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted requ CVE-2025-42608.3A vulnerability was found in zhangyanbo2007 youkefu up to 4.2.0 and classified as problematic. Affected by this issue is the function impsav CVE-2025-426008.2This vulnerability exists in Meon KYC solutions due to missing restrictions on the number of incorrect One-Time Password (OTP) attempts thro CVE-2025-426018.2This vulnerability exists in Meon KYC solutions due to insufficient server-side validation of the Captcha in certain API endpoints. A remote CVE-2025-426028.2This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API endpoints of authentica CVE-2025-426038.7This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of cert