GCVE - cpe:2.3:a:netwin:surgeftp:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:netwin:surgeftp:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Netwin (`84440f9c-0c8f-54f6-a00b-4d1ca5722029`)
Product	Surgeftp (`720c321e-b60b-53ef-9427-9fc11718e7dd`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-4742`	vulnerable	2026-06-08 05:04:49.517541	Details available Buffer overflow in NetWin SurgeFTP before 23d2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string within the authentication request. Published: 2013-08-09T21:00:00.000Z Updated: 2024-08-06T16:52:27.001Z Open on db.gcve.eu Reference links http://secunia.com/advisories/54188 https://exchange.xforce.ibmcloud.com/vulnerabilities/85922 http://osvdb.org/95582 http://www.securityfocus.com/bid/61403 http://archives.neohapsis.com/archives/bugtraq/2013-07/0149.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-10028`	vulnerable	2026-06-08 05:00:46.886038	Netwin SurgeFTP <= v23c8 Authenticated RCE Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to `surgeftpmgr.cgi`. This can lead to full remote code execution on the underlying system. Published: 2025-08-05T20:04:20.181Z Updated: 2026-05-15T11:13:55.331Z Open on db.gcve.eu Reference links https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/netwin_surgeftp_exec.rb https://www.exploit-db.com/exploits/23522 https://www.exploit-db.com/exploits/23601 https://netwinsite.com/surgeftp/ https://www.vulncheck.com/advisories/netwin-surgeftp-auth-rce	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-3769`	vulnerable	2026-06-08 04:49:54.893638	Details available Cross-site scripting (XSS) vulnerability in the mirrored server management interface in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to inject arbitrary web script or HTML via a malformed response without a status code, which is reflected to the user in the resulting error message. NOTE: this can be leveraged for root access via a sequence of steps involving web script that creates a new FTP user account. Published: 2007-07-15T21:00:00.000Z Updated: 2024-08-07T14:28:52.476Z Open on db.gcve.eu Reference links http://secunia.com/advisories/26061 http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070710/98374694/attachment-0031.txt https://exchange.xforce.ibmcloud.com/vulnerabilities/35378 http://www.vupen.com/english/advisories/2007/2528 http://osvdb.org/37911	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-3768`	vulnerable	2026-06-08 04:49:54.893203	Details available The mirror mechanism in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to cause a denial of service (restart) via a malformed response to a PASV command. Published: 2007-07-15T21:00:00.000Z Updated: 2024-08-07T14:28:52.379Z Open on db.gcve.eu Reference links http://secunia.com/advisories/26061 http://osvdb.org/37909 http://securityreason.com/securityalert/2883 http://www.vupen.com/english/advisories/2007/2528 https://exchange.xforce.ibmcloud.com/vulnerabilities/35376	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2001-0697`	vulnerable	2026-06-08 04:45:20.674799	Details available NetWin SurgeFTP prior to 1.1h allows a remote attacker to cause a denial of service (crash) via an 'ls ..' command. Published: 2002-03-09T05:00:00.000Z Updated: 2024-08-08T04:30:06.066Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/165816 https://exchange.xforce.ibmcloud.com/vulnerabilities/6168 http://www.secadministrator.com/Articles/Index.cfm?ArticleID=20200 http://netwinsite.com/surgeftp/manual/updates.htm http://www.securityfocus.com/bid/2442	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.