Security55 mOctober 24, 2026, 00:21

CISA adds 11-year-old ProFTPD mod_copy flaw to exploited list

On October 8, 2026, CISA added CVE-2015-3306 to its Known Exploited Vulnerabilities catalog. The flaw in ProFTPD 1.3.5's mod_copy module lets unauthenticated attackers copy arbitrary files via SITE CPFR and SITE CPTO, enabling code execution when paired with a web server. CVSS 3.1 score is 10.0.

DEV Community

Open source

CISA adds 11-year-old ProFTPD mod_copy flaw to exploited list

CVE-2015-3306 was published in May 2015 and entered KEV on October 8, 2026
mod_copy needs no authentication and does not restrict paths to the home directory
CVSS 3.1 base score is 10.0, vector AV:N/AC:L/PR:N/UI:N/S:C
Mitigation: disable the module or check logs for SITE CPFR and SITE CPTO

#ProFTPD#CISA

CISA adds five flaws to Known Exploited Vulnerabilities catalog

Security

CVE-2026-42167: ProFTPD mod_sql RCE and How to Analyze the Exploit-DB PoC

Security

CISA adds JFrog Artifactory auth bypass to exploited vulnerabilities list

Security

CISA adds 11-year-old ProFTPD mod_copy flaw to exploited list

CISA adds five flaws to Known Exploited Vulnerabilities catalog

CVE-2026-42167: ProFTPD mod_sql RCE and How to Analyze the Exploit-DB PoC

CISA adds JFrog Artifactory auth bypass to exploited vulnerabilities list

CISA adds Cisco ISE CVE-2026-76460 to exploited vulnerabilities list