{"id":"CVE-2025-4237","aliases":["EUVD-2025-13361","GHSA-q4pq-24r3-gcxj"],"status":"published","title":"PCMan FTP Server MDELETE Command buffer overflow","description":"A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component MDELETE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00742,"percentile":0.54928,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119","CWE-120"],"published":"2025-05-03T15:00:06Z","modified":"2026-06-17T09:32:50Z","products":[{"vendor":"pcman","product":"ftp server"},{"vendor":"pcman","product":"ftp_server"}],"references":[{"url":"https://vuldb.com/?id.307328","tags":["vdb-entry","Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/?ctiid.307328","tags":["signature","permissions-required","Permissions Required","VDB Entry"]},{"url":"https://vuldb.com/?submit.561536","tags":["third-party-advisory","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://fitoxs.com/exploit/exploit-c4ca4238a0b923820dcc509a6f75849b.txt","tags":["broken-link","exploit","Exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4237"},{"url":"https://github.com/advisories/GHSA-q4pq-24r3-gcxj"}],"sources":{"cve":[{"id":"CVE-2025-4237","title":"PCMan FTP Server MDELETE Command buffer overflow","description":"A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component MDELETE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-05-03T15:00:06.769Z","modified":"2025-05-06T14:29:22.435Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"},{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","assessor":"cna"}],"cwes":["CWE-120","CWE-119"],"updated_at":"2026-11-02T14:32:48.512547Z"}],"euvd":[{"id":"EUVD-2025-13361","description":"A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component MDELETE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-05-03T15:00:06Z","modified":"2025-05-06T14:29:22Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:32:54.858112Z"}],"ghsa":[{"id":"GHSA-q4pq-24r3-gcxj","title":"A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this...","description":"A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component MDELETE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-05-03T15:30:25Z","modified":"2025-05-03T15:30:33Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:02:06.913728Z"}],"nvd":[{"id":"CVE-2025-4237","description":"A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component MDELETE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-05-03T15:15:46.19Z","modified":"2026-06-17T09:32:50.553Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"secondary"}],"cwes":["CWE-119","CWE-120"],"updated_at":"2026-11-02T14:11:04.33372Z"}]}}