CVE-2015-3306Critical· 10.0▾ Hadal⚠ Exploited in the wildPoC availableThe mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 55 · likelihood 19.9 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 4 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Oct 11, 2026
97%
Last analysed / modified upstream
97% → 99%
Exploit-DB · 18 GitHub repos · Metasploit ×1 · Nuclei ×1 (last check)
Added to the CISA catalog on Oct 8, 2026. Federal remediation due Oct 11, 2026. View catalog ↗
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
fedora = 20fedora = 21fedora = 22debian_linux = 7.0debian_linux = 8.0debian_linux = 9.0tumbleweedlinux_enterprise_server = 15proftpd = 1.3.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-40766Critical· 9.8An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash
CVE-2025-1391Medium· 5.4A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern
CVE-2025-23367Medium· 6.5A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider
CVE-2010-20103Critical· 9.8A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010
CVE-2020-26160High· 7.5jwt-go: access restriction bypass vulnerability (CVE-2020-26160)
CVE-2026-42167High· 8.1mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROG…