CVE-2025-4288

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RNFR Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
PCMan	FTP Server	2.0.7

References

https://fitoxs.com/exploit/exploit-aab361888e671e1705f94c27c26f9bc7c9c63d3c66d5df89e31dcaf7fa17f528.txtExploit
https://vuldb.com/?ctiid.307395Permissions Required
https://vuldb.com/?id.307395Third Party Advisory, VDB Entry
https://vuldb.com/?submit.561625Exploit, Third Party Advisory, VDB Entry

Timeline

Published: May 5, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-428809.9Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enable CVE-2025-428824.3Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could exe CVE-2025-428832.7Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with admini CVE-2025-428846.5SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI look CVE-2025-428855.8Due to missing authentication, SAP HANA 2.0 (hdbrss) allows an unauthenticated attacker to call a remote-enabled function that will enable t CVE-2025-428866.1Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could generate a maliciou CVE-2025-428879.9Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enable CVE-2025-428885.5SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process m CVE-2025-428895.4SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a resu CVE-2025-42899.8A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component RNTO Co CVE-2025-4289010.0SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing att CVE-2025-428915.5Due to a missing authorization check in SAP Enterprise Search for ABAP, an attacker with high privileges may read and export the contents of