CVE-2025-4844

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of the component CD Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
FreeFloat	FTP Server	1.0

References

https://fitoxs.com/exploit/exploit-4378c99fc0e41aa7fd3122bea6a2dbec7f95b6daec45d1f9478a6d540799529c.txtExploit
https://vuldb.com/?ctiid.309313Permissions Required, VDB Entry
https://vuldb.com/?id.309313Third Party Advisory, VDB Entry
https://vuldb.com/?submit.572475Third Party Advisory, VDB Entry

Timeline

Published: May 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-484436.6Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Local Privilege Escalation Vulnerabil CVE-2025-484445.3Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 befo CVE-2025-484458.8Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Euroban CVE-2025-484468.8Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphaban CVE-2025-484477.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgallery allows Cross-Site CVE-2025-484486.5Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affect CVE-2025-48459.8A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functi CVE-2025-484595.3Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0.5. Users are recom CVE-2025-48469.8A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component MPUT CVE-2025-484615.0Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as CVE-2025-484624.2Successful exploitation of the vulnerability could allow an attacker to consume all available session slots and block other users from loggi CVE-2025-484633.1Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as