CVE-2020-5196

Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 is affected. An authenticated attacker could bypass permissions via the zip/unzip features to create files, view hidden files, and list directories/files without having zip/download (or unzip/upload) rights. The root caus...

CVE-2019-25046

Cerberus FTP Server Enterprise Web Client versions before 10.0.19 and 11.x before 11.0.4 are affected by an SVG-based XSS vulnerability. The issue arises from processing SVG documents in the Web Client, enabling cross-site scripting. Mitigation: upgrade to Cerberus FTP Server Enterprise 10.0.19 o...

CVE-2004-2769

Cerberus FTP Server before 4.0.3.0 is vulnerable. Remote authenticated users can list hidden files even when the Display hidden files option is disabled via MLSD/MLST commands. The Nessus NASL plugin for Cerberus FTP Server MLSD and MLST Command Hidden Files Security Bypass confirms affected vers...

CVE-2020-5195

Cerberus FTP Server contains a reflected XSS in the IMG element (folder_up.png) that affects versions prior to 11.0.1 and 10.0.17. The vulnerability arises from improper sanitization of user-inserted directory paths in a public/shared folder URL, enabling a remote attacker to execute arbitrary Ja...

CVE-2017-6367

CVE-2017-6367 affects Cerberus FTP Server 8.0.10.1. A crafted HTTP request using a long Host header and an invalid Content-Length header crashes the Windows service, yielding a denial-of-service condition. Public sources in the connected documents describe PoC/replay exploits and indicate the vul...

CVE-2020-5194

CVE-2020-5194 affects Cerberus FTP Server 8 where the zip API endpoint (file/ajax_download_zip/zip_name) permits an authenticated user without zip permission to use the zip function via an unrestricted API endpoint due to improper permission verification. The result is that such a user can zip an...

CVE-2012-2999

Cerberus FTP Server is vulnerable to cross-site request forgery (CSRF) in the web interface on versions prior to 5.0.5.0. The flaw allows an authenticated administrator’s session to be hijacked to perform actions such as adding a user or changing FTP service state via requests like /usermanager/u...

CVE-2012-5301

Cerberus FTP Server prior to version 5.0.4.0 is affected by a DES cipher weakness in SSH sessions, allowing potential eavesdropping and easier brute-force attacks on encrypted traffic. The vulnerability stems from default configurations that enable DES, increasing the risk of sensitive data discl...

CVE-2012-6339

Cerberus FTP Server has multiple XSS vulnerabilities in the Web Administration interface (log viewer and servermanager commands) affecting versions before 5.0.6.0. An attacker could inject arbitrary web script/HTML through log entries in the Log Manager or through a Messages field in servermanage...

CVE-2026-6265

CVE-2026-6265 is a local privilege escalation in Cerberus FTP Server on Windows due to insecure preserved inherited permissions. The issue affects Cerberus FTP Server versions up to and including 2025.4.2 and is resolved in version 2026.1. The CVSS-derived metrics indicate a high impact with loca...