CVE-2009-4795: Xlightftpd Xlight FTP Server

Medium severity, CVSS 6.8. EPSS: 2% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in Xlight FTP Server before 3.2.1, when ODBC authentication is enabled, allow remote attackers to execute arbitrary SQL commands via the (1) USER (aka username) or (2) PASS (aka password) command.

Affected products

• Xlightftpd Xlight FTP Server: up to and including 3.2; version 1.60 only; version 1.61 only; version 1.62 only; version 1.62a only; version 1.64 only; …

Published 2010-04-22. Last modified 2026-06-16.