PT-2025-31980 · Netwin · Surgeftp

Name of the Vulnerable Software and Affected Versions: Netwin SurgeFTP versions 23c8 and earlier Description: Netwin SurgeFTP contains a flaw in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to the surgeftpmgr.c...

NetWin Netwin SurgeFTP 安全漏洞

NetWin Netwin SurgeFTP is a multi-platform FTP server software from NetWin New Zealand. A security vulnerability exists in NetWin Netwin SurgeFTP version 23c8 and prior versions, which stems from an improper handling of POST requests and could lead to remote command execution...

CVE-2012-10028: Improper Neutralization of Special Elements used in an OS Command

Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to surgeftpmgr.cgi. This can lead to full remote code execution on the underlying system...

CVE-2012-10028

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/netwinsurgeftpexec.rb 2025-10-23 21:12:56+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7 2026-09-08 06:50:04+00:00| seen|...

NetWin SurgeFTP cgi/surgeftpmgr.cgi file cross-site scripting vulnerability

NetWin SurgeFTP is an FTP server from NetWin New Zealand. The server supports platforms such as Windows and Linux and provides SSL/TLS encryption. A cross-site scripting vulnerability exists in the cgi/surgeftpmgr.cgi file Web Manager interface on TCP port 7021 or 9021 in NetWin SurgeFTP version...

NetWin SurgeFTP 23f2 Cross Site Scripting Vulnerability

NetWin SurgeFTP version 23f2 suffers from multiple persistent cross site scripting vulnerabilities. Exploit Title: Multiple stored Cross-site scripting in NetWin SurgeFTP version 23f2 CVE: CVE-2017-17933 Date: 27-12-2017 Exploit Author: Aloyce J. Makalanga Contact: https://twitter.com/aloycemjr...

NetWin SurgeFTP 23f2 Cross Site Scripting Vulnerability

Exploit for cgi platform in category web applications Exploit Title: Multiple stored Cross-site scripting in NetWin SurgeFTP version 23f2 CVE: CVE-2017-17933 Date: 27-12-2017 Exploit Author: Aloyce J. Makalanga Contact: https://twitter.com/aloycemjr Vendor Homepage: http://netwinsite.com Category...

CVE-2017-17933

cgi/surgeftpmgr.cgi aka the Web Manager interface on TCP port 7021 or 9021 in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter...

Design/Logic Flaw

cgi/surgeftpmgr.cgi aka the Web Manager interface on TCP port 7021 or 9021 in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter...

CVE-2017-17933

cgi/surgeftpmgr.cgi aka the Web Manager interface on TCP port 7021 or 9021 in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter...

CVE-2017-17933

NetWin SurgeFTP 23f2 contains a stored cross-site scripting (XSS) flaw in the Web Manager CGI at cgi/surgeftpmgr.cgi (ports 7021/9021). The vulnerability arises from insufficient input filtering for the classid, domainid, and username parameters, enabling an attacker to inject malicious scripts. ...

CVE-2017-17933

cgi/surgeftpmgr.cgi aka the Web Manager interface on TCP port 7021 or 9021 in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter...

CVE-2017-17933: Improper Neutralization of Input During Web Page Generation

cgi/surgeftpmgr.cgi aka the Web Manager interface on TCP port 7021 or 9021 in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter...

NetWin SurgeFTP 23f2 Cross Site Scripting

Exploit Title: Multiple stored Cross-site scripting in NetWin SurgeFTP version 23f2 CVE: CVE-2017-17933 Date: 27-12-2017 Exploit Author: Aloyce J. Makalanga Contact: https://twitter.com/aloycemjr Vendor Homepage: http://netwinsite.com Category: webapps Attack Type: Remote Impact: Code execution 1...

SurgeFTP Multiple XSS Vulnerabilities (Nov 2015) - Active Check

SurgeFTP Server is prone to multiple stored cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Netwin SurgeFTP 23d6 Cross Site Scripting

Exploit Netwin SurgeFTP Sever Stored Cross Site Scripting Vulnerabilities Date: 11/18/2015 Exploit Author: UnN0n Vendor: NetWin Software Link: http://netwinsite.com/cgi-bin/keycgi.exe?cmd=download&product=surgeftp Version: 23d6 Tested on: Windows 7 x6464bit Info Surgeftp web-interface suffers wit...

Netwin SurgeFTP Sever 23d6 - Stored Cross Site Scripting Vulnerabilities

Exploit for windows platform in category web applications Exploit Netwin SurgeFTP Sever Stored Cross Site Scripting Vulnerabilities Date: 11/18/2015 Exploit Author: UnN0n Vendor: NetWin Software Link: http://netwinsite.com/cgi-bin/keycgi.exe?cmd=download&product=surgeftp Version: 23d6 Tested on:...

Netwin SurgeFTP Sever 23d6 存储型跨站脚本攻击漏洞.

No description provided by source...

Netwin SurgeFTP Sever 23d6 - Persistent Cross-Site Scripting

Netwin SurgeFTP Sever 23d6 - Persistent Cross-Site Scripting Exploit Netwin SurgeFTP Sever Stored Cross Site Scripting Vulnerabilities Date: 11/18/2015 Exploit Author: UnN0n Vendor: NetWin Software Link: http://netwinsite.com/cgi-bin/keycgi.exe?cmd=download&product=surgeftp Version: 23d6 Tested o...

Netwin SurgeFTP Sever 23d6 - Persistent Cross-Site Scripting

Exploit Netwin SurgeFTP Sever Stored Cross Site Scripting Vulnerabilities Date: 11/18/2015 Exploit Author: UnN0n Vendor: NetWin Software Link: http://netwinsite.com/cgi-bin/keycgi.exe?cmd=download&product=surgeftp Version: 23d6 Tested on: Windows 7 x6464bit Info Surgeftp web-interface suffers wit...