CVE-2026-38577

CVE-2026-38577 — Tenda HG21 Hardcoded Root Credentials Summary Field| Value ---|--- CVE ID| CVE-2026-38577 Vendor| Tenda Product| Tenda HG21 XPON Fiber Modem Affected Version| V4.0.0-260302 Product Key| HG21-V1.0-TDE01 Hardware Version| V1.0 Firmware Build Date| 2026-03-02 Firmware File|...

cve-2025-5548-freefloat-ftp-walkthrough

CVE-2025-5548 – FreeFloat FTP Server 1.0 Walkthrough Repository where we document step by step the analysis and controlled exploitation of CVE-2025-5548 on FreeFloat FTP Server 1.0 within a laboratory environment. In this project we do not limit ourselves to running a pre-made exploit. Our goal i...

vsftpd-backdoor

Exploit for the vsftpd 2.3.4 Backdoor CVE-2011-2523 This exploit takes advantage of a backdoor in version 2.3.4 of the vsftpd FTP service. The backdoor was maliciously introduced into the source code and allows remote command execution as root on the affected server How it works The backdoor is...

Kali-Metasploitable

Reporte de Auditoría y Laboratorio de Seguridad Proyecto: Análisis de Vulnerabilidades y Explotación de Red Segura Fecha: Abril 2026 Autor: Ivo Albacete 1. Resumen Ejecutivo Este proyecto consistió en el despliegue de un entorno controlado para la práctica de técnicas de ciberseguridad. Se...

CVE-2025-5548

🛡️ CVE-2025-5548 – FreeFloat FTP Server Buffer Overflow Exploit 📌 Overview This repository documents the discovery and exploitation of a stack-based buffer overflow vulnerability in the FreeFloat FTP Server application. The vulnerability resides in the handling of the USER command, where unsafe...

Linux Distros Unpatched Vulnerability : CVE-2026-88044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC...

Linux Distros Unpatched Vulnerability : CVE-2026-88017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy drive...

ssl-heartbleed.nse

ssl-heartbleed.nse Nmap NSE script that discovers/exploits Heartbleed/CVE-2014-0160. This script is now basically the one Patrik Karlsson wrote with some minor changes ported from my own script. Features Includes support for FTP,SMTP,XMPP...

CVE-2018-17873

CVE-2018-17873 WiFiRanger indoor routers Core, GoAC and their outdoor paired routers Sky Pro, EliteAC, EliteAC FM running firmware version 7.0.8rc3 and earlier allow anonymous FTP read/write access and have left the SSH Private Key in the clear - making it a trivial task to view/copy the key and...

Explotando-FreeFloatFTP-CVE-2025-5548

Exploiting-FreeFloatFTP-CVE-2025-5548 Welcome to my exploit research and development repository. This project documents the full technical analysis, environment setup, and step-by-step exploitation of CVE-2025-5548 Stack-Based Buffer Overflow found in FreeFloat FTP Server. 🌱 Personal note: This...

CVE-2025-471812-POC

root@kitploit: / | / | / / | / / / |/ // / / / / / / | | / /| |/ / / / / /|/ / / / / / /// /| |/ / | / // / / / // / /// |/ |/ // /// CVE-2025-47812 — Wing FTP Server = 7.4.3 RCE no autenticada Exploit de prueba de concepto para CVE-2025-47812 , una vulnerabilidad de ejecución remota de código...

GHSA-P569-5GJG-9CMJ rclone: RC per-server auth-proxy bypass

Summary serve/start accepts protocol options in a per-server proxyOpt object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global proxy.Opt.AuthProxy instead of th...

rclone: RC per-server auth-proxy bypass

Summary serve/start accepts protocol options in a per-server proxyOpt object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global proxy.Opt.AuthProxy instead of th...

GHSA-C476-6W5Q-JW77 rclone: FTP cross-session auth-proxy backend confusion

Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind the credential or returned VFS to the authenticated FTP session. If two accepted credentials use the same username but resolve to different proxy backends, the later login overwrites...

rclone: FTP cross-session auth-proxy backend confusion

Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind the credential or returned VFS to the authenticated FTP session. If two accepted credentials use the same username but resolve to different proxy backends, the later login overwrites...

CVE-2025-5548-Exploit-Development

CVE-2025-5548 - Exploit Development Lab This repository documents the process of setting up a working environment for vulnerability analysis and exploit development, and applying it to a practical buffer overflow case study. The project is built around FreeFloat FTP Server 1.0, used as an...

CVE-2025-5548

🧪 FreeFloat FTP Server Buffer Overflow Lab CVE-2025-5548 📌 Description This lab demonstrates how to exploit a Stack Buffer Overflow vulnerability in FreeFloat FTP Server , identified as CVE-2025-5548. The objective is to understand the complete exploitation process on vulnerable Windows...

CVE-2025-5548

🐞 CVE-2025-5548: FreeFloat FTP Server 1.0 Buffer Overflow Professional research and exploit development for a classic stack-based buffer overflow in FreeFloat FTP Server 1.0. This laboratory demonstrates the transition from binary reversing to a fully functional RCE. 📖 Executive Summary This...

CVE-2025-47812-PoC

CVE-2025-47812 — Wing FTP Server Remote Code Execution RCE Overview...

CVE-2026-88044

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go...