Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Coreftp

First CVE: Jun 3, 2008Active for: 18 yearsTotal CVEs: 20
45.6
VTI Score
High

CoreFTP is a focused file-transfer client and server product that, despite a narrow product scope, ranks among more prominent vendors in the vulnerability landscape, likely reflecting widespread adoption in enterprise and managed-service environments. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity and a strong tendency to acquire public exploit code; the exposure recurs through memory-safety and access-control weaknesses including buffer overflows, out-of-bounds writes, path traversal, and race conditions that are characteristic of native FTP implementations handling untrusted network input. Defenders should prioritize patching for this vendor and restrict FTP service exposure; live severity, exploitation, and exposure counts are shown alongside this summary.

FAUCET AI Generated
20
Total CVEs
More Total CVEs than 96% of tracked vendors
1.1
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 74% of tracked vendors
6.7
Avg CVSS Score
Higher Avg CVSS Score than 43% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Coreftp over time

Volume of CVEsAvg CVSS Base Score
First CVE
Jun 3, 2008
18 years ago
Most Recent CVE
Apr 5, 2026
110 days ago

Products(2 total)

Top CVEs

Signals from CVEs in this vendor scope (20 CVEs).

20 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2018-20658HIGH
The server in Core FTP 2.0 build 653 on 32-bit platforms allows remote attackers to cause a denial of service (daemon crash) via a crafted XRMD command.
Jan 2, 20197.538NOYES
CVE-2009-3484HIGH
Stack-based buffer overflow in Core FTP 2.1 build 1612 allows user-assisted remote attackers to execute arbitrary code via a long hostname in an FTP server entry in a site backup f
Sep 30, 20099.335NOYES
CVE-2022-22836MEDIUM
CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.
Jan 10, 20226.534NOYES
CVE-2018-12113CRITICAL
Core FTP LE version 2.2 Build 1921 is prone to a buffer overflow vulnerability that may result in a DoS or remote code execution via a PASV response.
Jul 5, 20189.831NONO
CVE-2020-19596CRITICAL
Buffer overflow vulnerability in Core FTP Server v1.2 Build 583, via a crafted username.
Apr 5, 20219.829NONO
CVE-2019-9649MEDIUM
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal technique (..\..\) to br
Mar 22, 20195.329NOYES
CVE-2019-9648MEDIUM
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, al
Mar 22, 20195.329NOYES
CVE-2019-25654HIGH
Core FTP/SFTP Server 1.2 contains a buffer overflow vulnerability that allows attackers to crash the service by supplying an excessively long string in the User domain field. Attac
Mar 30, 20267.526NONO
CVE-2014-4643MEDIUM
Multiple heap-based buffer overflows in the client in Core FTP LE 2.2 build 1798 allow remote FTP servers to cause a denial of service (application crash) and possibly execute arbi
Jun 25, 20145.026NOYES
CVE-2019-25686HIGH
Core FTP 2.0 build 653 contains a denial of service vulnerability in the PBSZ command that allows unauthenticated attackers to crash the service by sending a malformed command with
Apr 5, 20267.525NONO
View all 20 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products20 CVEs
55%
35%
10%
Severity distribution among all CVEs352,294 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local3 (15.0%)
Network9 (45.0%)
Unknown8 (40.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low12 (60.0%)
High0 (0.0%)
Unknown8 (40.0%)
User Interaction
None11 (55.0%)
Unknown8 (40.0%)
Required1 (5.0%)
Privileges Required
Low3 (15.0%)
High0 (0.0%)
None9 (45.0%)
Unknown8 (40.0%)

Exploit Exposure

Signals from CVEs in this vendor scope (20 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
6 CVEs
30.0% of CVEs· 79th percentile

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Coreftp.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Coreftp — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Coreftp's Products

View all 3 CNAs →

Top CWEs