CVE-2009-4795

CVE-2009-4795 : In Xlight FTP Server prior to 3.2.1, when ODBC authentication is enabled, remote attackers can trigger SQL injection through the USER (username) or PASS (password) commands. The underlying issue is the server processing user-supplied credentials in SQL without proper validation, a...

CVE-2010-2695

Xlight FTP Server 3.x is affected by a directory traversal vulnerability in the SFTP/SSH2 virtual server. Versions 3.5.0 and 3.5.5 (and possibly others) before 3.6 allow remote authenticated users to read, overwrite, or delete arbitrary files by crafting .. sequences in commands such as ls, rm, r...

CVE-2024-0737

CVE-2024-0737 affects Xlightftpd Xlight FTP Server 1.1, specifically the Login component where manipulating the user argument can cause a remote denial of service. Public disclosures (including Exploit-DB/PacketStorm entries) indicate an attacker can trigger the issue remotely; exploitation activ...

CVE-2023-53886

Xlight FTP Server 3.9.3.6 is affected by a stack buffer overflow in the Execute Program configuration. Triggering with 294 characters can cause an application crash/DoS. Multiple sources (Red Hat, ENISA EUVD, NVD, CVE list) confirm the issue and its impact; public exploit references exist (e.g., ...

CVE-2019-25681

CVE-2019-25681 affects Xlight FTP Server 3.9.1. The issue is a structured exception handler (SEH) overwrite that allows a local attacker to crash the application and overwrite SEH pointers by sending a crafted buffer. Specifically, a 428-byte payload injected via the program execution field in th...