CVE-2025-5594

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. This vulnerability affects unknown code of the component SET Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
FreeFloat	FTP Server	1.0

References

https://fitoxs.com/exploit/exploit-79d290eb2c875b417f7a91769b3bb07a64f2562b57484473ef0f92808bb7dbe2.txtExploit
https://vuldb.com/?ctiid.311080Permissions Required, VDB Entry
https://vuldb.com/?id.311080Third Party Advisory, VDB Entry
https://vuldb.com/?submit.587009Exploit, Third Party Advisory, VDB Entry
https://fitoxs.com/exploit/exploit-79d290eb2c875b417f7a91769b3bb07a64f2562b57484473ef0f92808bb7dbe2.txtExploit

Timeline

Published: Jun 4, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-559446.1Slink v1.4.9 allows stored cross-site scripting (XSS) via crafted SVG uploads. When a user views the shared image in a new browser tab, the CVE-2025-559487.3This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control (RBAC) through dual de CVE-2025-55959.8A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. This issue affects some unknown processing of the componen CVE-2025-55969.8A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. Affected is an unknown function of the component CVE-2025-559710.0Improper Authentication vulnerability in WF Steuerungstechnik GmbH airleader MASTER allows Authentication Bypass.This issue affects airleade CVE-2025-559714.7TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthentic CVE-2025-559727.5A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS) CVE-2025-559768.4Intelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. Any unauthenticated user on the local netw CVE-2025-55989.2Path Traversal vulnerability in WF Steuerungstechnik GmbH airleader MASTER allows Retrieve Embedded Sensitive Data.This issue affects airlea CVE-2025-559887.2An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via CVE-2025-55999.8A vulnerability classified as critical was found in PHPGurukul Student Result Management System 1.3. This vulnerability affects unknown code CVE-2025-559966.3Viber Desktop 25.6.0 is vulnerable to HTML Injection via the text parameter of the message compose/forward interface