CVE-2015-3306Vulnerability

1. “CVE-2015-3306 (CVSS score of 10.0) – An access control flaw in ProFTPD that could let remote attackers read or modify arbitrary files by abusing the SITE CPFR and SITE CPTO commands.”

   Security AffairsNews11 Oct 2026
   U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog

2. “CVE-2015-3306 (CVSS score: 10.0) - An improper access control vulnerability in ProFTPD that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.”

   The Hacker NewsNews9 Oct 2026
   Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

3. “…, the US Cybersecurity and Infrastructure Security Agency (CISA) has added five CVEs to its Known Exploited Vulnerabilities Catalog: CVE-2015-3306 CVE-2015-5477 CVE-2016-3081 CVE-2021-3199 CVE-2023-22894 The court-authorized seizures are the latest in a long series of US law-enfo…”

   The Register (security)News8 Oct 2026
   US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide

4. “CVE-2015-3306*”

   The Hacker NewsNews8 Oct 2026
   FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails

5. “CVE-2015-3306”

   CISA advisoriesGovernment8 Oct 2026
   Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

• dns.studiocloud[.]xyzin 1 report
• natcloudservice[.]comin 1 report
• 2.3.20[.]2in 1 report
• 2.3.24[.]1in 1 report
• 2.3.20[.]3in 1 report
• 2.3.24[.]3in 1 report
• 2.3.28[.]1in 1 report
• c0cc[.]ccin 1 report
• 98aicai[.]comin 1 report
• 98aicode[.]comin 1 report
• outlook3650[.]comin 1 report
• youtubecard[.]comin 1 report
• linkedinns[.]netin 1 report

Also named with it: CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, CVE-2023-22894, CVE-2019-11510, CVE-2014-6278, CVE-2021-22205