CVE-2025-5109

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component STATUS Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
FreeFloat	FTP Server	1.0

References

https://fitoxs.com/exploit/exploit-0420d1a7d4e6b45cf1f0b87c2d580c4df77281242d0e9d1b77d7e2fd08f3a41d.txtExploit
https://vuldb.com/?ctiid.310086Permissions Required, VDB Entry
https://vuldb.com/?id.310086Third Party Advisory, VDB Entry
https://vuldb.com/?submit.581298Third Party Advisory, VDB Entry
https://fitoxs.com/exploit/exploit-0420d1a7d4e6b45cf1f0b87c2d580c4df77281242d0e9d1b77d7e2fd08f3a41d.txtExploit
https://vuldb.com/?submit.581298Third Party Advisory, VDB Entry

Timeline

Published: May 23, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-510929.8The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php. The fu CVE-2025-51109.8A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of CVE-2025-51119.8A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functi CVE-2025-51129.8A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component MGET CVE-2025-51138.6The Diviotec professional series exposes a web interface. One endpoint is vulnerable to arbitrary command injection and hardcoded passwords CVE-2025-51149.1A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the function Edit CVE-2025-51157.5In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_S CVE-2025-51166.4The WP Plugin Info Card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘containerid’ parameter in all versions up CVE-2025-51178.8The Property plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the use of the property_package CVE-2025-51199.8A vulnerability has been found in Emlog Pro 2.5.11 and classified as critical. This vulnerability affects unknown code of the file /include/CVE-2025-512010.0A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted executio CVE-2025-51219.9An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.4 and 18.0 before 18.0.2. A missing authorizatio