proftpd_project 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
過去の問題は主に バッファオーバーフロー and vendor risk sql injection などに関し、一部は アプリケーションクラッシュ を招き、vendor surface software deployment and vendor surface production workloads 関連の場面に影響します。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2009-0542 | SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which introduces a "'" (single quote) character during variable substitution by mod_sql. | [email protected] | 7.5 | 58.49% | 2009-02-12 | 2026-04-23 |
| CVE-2008-4242 | ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser. | [email protected] | 6.8 | 3.38% | 2008-09-25 | 2026-04-23 |
| CVE-2007-2165 | The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as demonstrated by use of SQLAuthTypes Plaintext in mod_sql, with data retrieved from /etc/passwd. | [email protected] | 5.1 | 3.78% | 2007-04-22 | 2026-04-23 |
| CVE-2006-6563 | Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value. | [email protected] | 6.6 | 0.17% | 2006-12-15 | 2026-04-23 |
| CVE-2006-6171 | ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow. NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from a vague initial disclosure. NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected | [email protected] | 7.5 | 4.78% | 2006-11-30 | 2026-04-23 |
| CVE-2006-6170 | Buffer overflow in the tls_x509_name_oneline function in the mod_tls module, as used in ProFTPD 1.3.0a and earlier, and possibly other products, allows remote attackers to execute arbitrary code via a large data length argument, a different vulnerability than CVE-2006-5815. | [email protected] | 7.5 | 14.38% | 2006-11-30 | 2026-04-23 |
| CVE-2006-5815 | Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers, probably authenticated, to cause a denial of service and execute arbitrary code, as demonstrated by vd_proftpd.pm, a "ProFTPD remote exploit." | [email protected] | 10.0 | 74.73% | 2006-11-08 | 2026-04-23 |
| CVE-2005-4816 | Buffer overflow in mod_radius in ProFTPD before 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password. | [email protected] | 7.5 | 2.84% | 2005-12-31 | 2026-04-16 |
| CVE-2005-2390 | Multiple format string vulnerabilities in ProFTPD before 1.3.0rc2 allow attackers to cause a denial of service or obtain sensitive information via (1) certain inputs to the shutdown message from ftpshut, or (2) the SQLShowInfo mod_sql directive. | [email protected] | 6.4 | 1.23% | 2005-07-27 | 2026-04-16 |
| CVE-2004-0432 | ProFTPD 1.2.9 treats the Allow and Deny directives for CIDR based ACL entries as if they were AllowAll, which could allow FTP clients to bypass intended access restrictions. | [email protected] | 7.5 | 1.23% | 2004-08-18 | 2026-04-16 |
| CVE-2003-0831 | ProFTPD 1.2.7 through 1.2.9rc2 does not properly translate newline characters when transferring files in ASCII mode, which allows remote attackers to execute arbitrary code via a buffer overflow using certain files. | [email protected] | 9.0 | 40.88% | 2003-11-17 | 2026-04-16 |
| CVE-2003-0500 | SQL injection vulnerability in the PostgreSQL authentication module (mod_sql_postgres) for ProFTPD before 1.2.9rc1 allows remote attackers to execute arbitrary SQL and gain privileges by bypassing authentication or stealing passwords via the USER name. | [email protected] | 10.0 | 1.56% | 2003-08-07 | 2026-04-16 |
| CVE-2001-1501 | The glob functionality in ProFTPD 1.2.1, and possibly other versions allows remote attackers to cause a denial of service (CPU and memory consumption) via commands with large numbers of wildcard and other special characters, as demonstrated using an ls command with multiple (1) "*/..", (2) "*/.*", or (3) ".*./*?/" sequences in the argument. | [email protected] | 5.0 | 8.15% | 2001-12-31 | 2026-04-16 |
| CVE-2001-1500 | ProFTPD 1.2.2rc2, and possibly other versions, does not properly verify reverse-resolved hostnames by performing forward resolution, which allows remote attackers to bypass ACLs or cause an incorrect client hostname to be logged. | [email protected] | 7.5 | 1.08% | 2001-12-31 | 2026-04-16 |
| CVE-2001-0318 | Format string vulnerability in ProFTPD 1.2.0rc2 may allow attackers to execute arbitrary commands by shutting down the FTP server while using a malformed working directory (cwd). | [email protected] | 7.5 | 0.86% | 2001-06-02 | 2026-04-16 |
| CVE-2001-0027 | mod_sqlpw module in ProFTPD does not reset a cached password when a user uses the "user" command to change accounts, which allows authenticated attackers to gain privileges of other users. | [email protected] | 7.5 | 0.82% | 2001-02-12 | 2026-04-16 |
| CVE-1999-1475 | ProFTPd 1.2 compiled with the mod_sqlpw module records user passwords in the wtmp log file, which allows local users to obtain the passwords and gain privileges by reading wtmp, e.g. via the last command. | [email protected] | 4.6 | 0.10% | 1999-11-19 | 2026-04-16 |
| CVE-1999-0911 | Buffer overflow in ProFTPD, wu-ftpd, and beroftpd allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories. | [email protected] | 10.0 | 21.29% | 1999-08-27 | 2026-04-16 |
| CVE-1999-0368 | Buffer overflows in wuarchive ftpd (wu-ftpd) and ProFTPD lead to remote root access, a.k.a. palmetto. | [email protected] | 10.0 | 48.33% | 1999-02-09 | 2026-04-16 |