tag
Ftp
Monsta FTP Pre-Authentication Remote Code Execution via Arbitrary File Upload (CVE-2025-34299)
Monsta FTP versions up to and including 2.11.2 contain a pre-authentication, unrestricted arbitrary file upload vulnerability (CWE-434) in the downloadFile action of its /mftp/application/api/api.php endpoint. The endpoint accepts a user-supplied FTP…
ProFTPD mod_sql Pre-Auth SQL Injection Leading to RCE (CVE-2026-42167)
CVE-2026-42167 is a pre-authentication SQL injection in ProFTPD's modsql logging support. The module's isescapedtext() sanitizer fails to properly neutralize input used to populate logging variables (such as %U), which are substituted into SQL statements…
LiteSpeed cPanel/WHM Plugin Symlink Privilege Escalation — CVE-2026-54420
LiteSpeed's cPanel and WHM plugins mishandle user-supplied symbolic links on shared hosting servers isolated with CloudLinux/CageFS. A tenant with FTP or web shell access to their own account can create a symlink (via SITE SYMLINK, rename-based tricks, or…
Squidbleed — Squid Proxy FTP Gateway Out-of-Bounds Heap Read (CVE-2026-47729)
CVE-2026-47729, dubbed "Squidbleed," is an out-of-bounds heap read in Squid Proxy's FTP gateway and FTP directory-listing parser. The bug stems from legacy FTP parsing logic (originally written in 1997 for NetWare-style listings) in FtpGateway.cc, where…