CVE-2012-10023

A stack-based buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0. The server fails to properly validate input passed to the USER command, allowing remote attackers to overwrite memory and potentially execute arbitrary code. The flaw is triggered by sending an overly long username string, which overflows the buffer allocated for user authentication.

• CWE-121

• https://my.saintcorporation.com/cgi-bin/exploit_info/freefloat_ftp_server_user_cmdThird Party Advisory
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/freefloatftp_user.rbExploit
• https://web.archive.org/web/20101208040029/http://secunia.com/advisories/42465/Third Party Advisory
• https://web.archive.org/web/20101213050627/http://www.freefloat.com/sv/about-/about-.phpProduct
• https://www.exploit-db.com/exploits/15689Exploit
• https://www.exploit-db.com/exploits/23243Exploit
• https://www.vulncheck.com/advisories/freefloat-ftp-server-user-command-buffer-overflowThird Party Advisory
• https://www.exploit-db.com/exploits/23243Exploit

Published

Aug 5, 2025

Last Modified

Jun 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-10018The Mapplic and Mapplic Lite plugins for WordPress are vulne…8.3
• CVE-2012-10019The Front End Editor plugin for WordPress is vulnerable to a…9.8
• CVE-2012-1002SQL injection vulnerability in author/edit.php in OpenConf 4…
• CVE-2012-10020The FoxyPress plugin for WordPress is vulnerable to arbitrar…9.8
• CVE-2012-10021A stack-based buffer overflow vulnerability exists in D-Link…9.8
• CVE-2012-10022Kloxo versions 6.1.12 and earlier contain two setuid root bi…8.5
• CVE-2012-10024XBMC version 11.0 contains a path traversal vulnerability in…7.1
• CVE-2012-10025The WordPress plugin Advanced Custom Fields (ACF) version 3.…10
• CVE-2012-10026The WordPress plugin Asset-Manager version 2.0 and below con…10
• CVE-2012-10027WP-Property plugin for WordPress up to and including version…9.3
• CVE-2012-10028Netwin SurgeFTP version 23c8 and prior contains a vulnerabil…8.6
• CVE-2012-10029Nagios XI Network Monitor prior to Graph Explorer component …8.6