CVE-2025-5221
Last modified
CVE-2025-5221 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A vulnerability was found in FreeFloat FTP Server 1.0.0. It has been classified as critical. EPSS estimates a 0.59% chance of exploitation in the next 30 days.
Description
A vulnerability was found in FreeFloat FTP Server 1.0.0. It has been classified as critical. This affects an unknown part of the component QUOTE Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Freefloat | Freefloat Ftp Server | 1.0 |
References
- https://vuldb.com/?ctiid.310317Permissions Required, VDB Entry
- https://vuldb.com/?id.310317Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.582971Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-5221?
How severe is CVE-2025-5221?
How do I fix CVE-2025-5221?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-52196Server-Side Request Forgery (SSRF) vulnerability in Ctera Po…7.5
- CVE-2025-5220A vulnerability was found in FreeFloat FTP Server 1.0.0 and …9.8
- CVE-2025-52203A stored cross-site scripting (XSS) vulnerability exists in …7.6
- CVE-2025-52204A Cross-Site Scripting (XSS) vulnerability exists in Znuny::…6.1
- CVE-2025-52206ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) …4.7
- CVE-2025-52207PBXCoreREST/Controllers/Files/PostController.php in MikoPBX …9.9
- CVE-2025-52217SelectZero Data Observability Platform before 2025.5.2 is vu…5.4
- CVE-2025-52218SelectZero Data Observability Platform before 2025.5.2 is vu…7.5
- CVE-2025-52219SelectZero SelectZero Data Observability Platform before 202…6.5
- CVE-2025-5222A stack buffer overflow was found in Internationl components…7
- CVE-2025-52221Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow…9.8
- CVE-2025-52222D-Link DI-8003 v16.07.26A1, DI-8500 v16.07.26A1; DI-8003G v1…7.5
Are you affected by CVE-2025-5221?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST