High severityNVD Advisory· Published Aug 5, 2025· Updated Apr 15, 2026

CVE-2012-10028

Description

Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to surgeftpmgr.cgi. This can lead to full remote code execution on the underlying system.

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

netwinsite.com/surgeftp/nvd
raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/netwin_surgeftp_exec.rbnvd
www.exploit-db.com/exploits/23522nvd
www.exploit-db.com/exploits/23601nvd
www.vulncheck.com/advisories/netwin-surgeftp-auth-rcenvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.046
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000