CVE-2012-10028 — Netwin SurgeFTP <= v23c8 Authenticated RCE
Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via …
Published: 2025-08-05 · CVSS: 8.6 · CVSS 4.0
Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to `surgeftpmgr.cgi`. This can lead to full remote code execution on the underlying system.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7