CVE-2026-67193

Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the...

CVE-2026-67192

Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed...

CVE-2026-67191

Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses ...

CVE-2026-67192 Xlight FTP Server < 3.9.5 Pre-Auth Stack Buffer Overflow via SSH GCM Cipher

Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed...

EUVD-2026-50399

Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed...

CVE-2026-67192

Xlight FTP Server prior to 3.9.5 is affected by a pre-authentication stack-based buffer overflow when a GCM SSH cipher is negotiated. An unauthenticated attacker can craft malformed SSH packets with an unvalidated length field that is passed directly to the GCM decrypt function, potentially overw...

CVE-2026-67191

Xlight FTP Server prior to 3.9.5 is affected by a pre-authentication heap buffer overflow in the SSH parser. A logic error in the recv loop termination (OR instead of AND) enables exploitation on any SSH or SFTP connection before authentication, allowing remote unauthenticated access with high im...

EUVD-2019-20097

Xlight FTP Server 3.9.1 contains a structured exception handler SEH overwrite vulnerability that allows local attackers to crash the application and overwrite SEH pointers by supplying a crafted buffer string. Attackers can inject a 428-byte payload through the program execution field in virtual...

CVE-2019-25681

Xlight FTP Server 3.9.1 contains a structured exception handler SEH overwrite vulnerability that allows local attackers to crash the application and overwrite SEH pointers by supplying a crafted buffer string. Attackers can inject a 428-byte payload through the program execution field in virtual...

CVE-2019-25681 Xlight FTP Server 3.9.1 SEH Overwrite Buffer Overflow

Xlight FTP Server 3.9.1 contains a structured exception handler SEH overwrite vulnerability that allows local attackers to crash the application and overwrite SEH pointers by supplying a crafted buffer string. Attackers can inject a 428-byte payload through the program execution field in virtual...

CVE-2019-25681

Xlight FTP Server 3.9.1 contains a structured exception handler SEH overwrite vulnerability that allows local attackers to crash the application and overwrite SEH pointers by supplying a crafted buffer string. Attackers can inject a 428-byte payload through the program execution field in virtual...

Xlight FTP Server 缓冲区错误漏洞

Xlight FTP Server is an open-source FTP server software developed by Xlight. Version 3.9.1 of Xlight FTP Server contains a buffer error vulnerability. This vulnerability stems from a coverage issue with structured exception handlers, which may allow local attackers to cause the application to cra...

CVE-2023-53886

Xlight FTP Server 3.9.3.6 contains a stack buffer overflow vulnerability in the 'Execute Program' configuration that allows attackers to crash the application. Attackers can trigger the vulnerability by inserting 294 characters into the program execution configuration, causing a denial of service...

CVE-2023-53886

Xlight FTP Server 3.9.3.6 contains a stack buffer overflow vulnerability in the 'Execute Program' configuration that allows attackers to crash the application. Attackers can trigger the vulnerability by inserting 294 characters into the program execution configuration, causing a denial of service...

CVE-2023-53886

Xlight FTP Server 3.9.3.6 contains a stack buffer overflow vulnerability in the 'Execute Program' configuration that allows attackers to crash the application. Attackers can trigger the vulnerability by inserting 294 characters into the program execution configuration, causing a denial of service...

CVE-2023-53886

Xlight FTP Server 3.9.3.6 is affected by a stack buffer overflow in the Execute Program configuration. Triggering with 294 characters can cause an application crash/DoS. Multiple sources (Red Hat, ENISA EUVD, NVD, CVE list) confirm the issue and its impact; public exploit references exist (e.g., ...

CVE-2023-53886 Xlight FTP Server 3.9.3.6 Stack Buffer Overflow Vulnerability via Execute Program

Xlight FTP Server 3.9.3.6 contains a stack buffer overflow vulnerability in the 'Execute Program' configuration that allows attackers to crash the application. Attackers can trigger the vulnerability by inserting 294 characters into the program execution configuration, causing a denial of service...

CVE-2023-53886 Xlight FTP Server 3.9.3.6 Stack Buffer Overflow Vulnerability via Execute Program

Xlight FTP Server 3.9.3.6 contains a stack buffer overflow vulnerability in the 'Execute Program' configuration that allows attackers to crash the application. Attackers can trigger the vulnerability by inserting 294 characters into the program execution configuration, causing a denial of service...

Xlight FTP Server 安全漏洞

Xlight FTP Server is an FTP server software from Xlight open source. A security vulnerability exists in Xlight FTP Server version 3.9.3.6, which stems from a stack buffer overflow in the Execute Program configuration that could cause the application to crash...

PT-2025-51304

Name of the Vulnerable Software and Affected Versions Xlight FTP Server version 3.9.3.6 Description Xlight FTP Server 3.9.3.6 contains a stack buffer overflow issue in the 'Execute Program' configuration. An attacker can cause a denial of service by providing 294 characters to the program executi...