GCVE - cpe:2.3:a:monstaftp:monsta_ftp:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:monstaftp:monsta_ftp:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Monstaftp (`6bb41499-9089-5545-b32f-fe15d74d05e2`)
Product	Monsta Ftp (`cf882f86-7106-5579-896b-532d551df18c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/monstaapps/monsta-ftp`	purl2cpe	2026-06-01 10:12:06.690768

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-34299`	vulnerable	2026-06-08 07:19:02.915589	Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server. Published: 2025-11-07T13:51:33.738Z Updated: 2026-05-14T02:08:11.703Z Open on db.gcve.eu Reference links https://www.monstaftp.com/notes/ https://labs.watchtowr.com/whats-that-coming-over-the-hill-monsta-ftp-remote-code-execution-cve-2025-34299/ https://www.vulncheck.com/advisories/monsta-ftp-unauthenticated-arbitrary-file-upload	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-14057`	vulnerable	2026-06-08 05:18:01.969082	Details available Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. This allows attackers to read and write arbitrary local files, allowing an attacker to gain remote code execution in common deployments. Published: 2020-07-01T16:13:42.000Z Updated: 2024-08-04T12:32:14.681Z Open on db.gcve.eu Reference links https://www.monstaftp.com/notes/ https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20191203-01_Monsta_FTP_Arbitrary_File_Read_and_Write	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-14056`	vulnerable	2026-06-08 05:18:01.968747	Details available Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of the web fetch functionality. This allows attackers to read arbitrary local files and interact with arbitrary third-party services. Published: 2020-07-01T16:06:43.000Z Updated: 2024-08-04T12:32:14.700Z Open on db.gcve.eu Reference links https://www.monstaftp.com/notes/ https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20191203-02_Monsta_FTP_Server-Side_Request_Forgery	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-14055`	vulnerable	2026-06-08 05:18:01.968225	Details available Monsta FTP 2.10.1 or below is prone to a stored cross-site scripting vulnerability in the language setting due to insufficient output encoding. Published: 2020-07-01T16:10:29.000Z Updated: 2024-08-04T12:32:14.653Z Open on db.gcve.eu Reference links https://www.monstaftp.com/notes/ https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20191211-01_Monsta_FTP_Stored_XSS	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.