System	Score	Found at
epss	0.94051	https://api.first.org/data/v1/epss?cve=CVE-2015-3306
epss	0.94051	https://api.first.org/data/v1/epss?cve=CVE-2015-3306
epss	0.94051	https://api.first.org/data/v1/epss?cve=CVE-2015-3306
epss	0.94051	https://api.first.org/data/v1/epss?cve=CVE-2015-3306
epss	0.94137	https://api.first.org/data/v1/epss?cve=CVE-2015-3306

Reference id	Reference type	URL
		https://api.first.org/data/v1/epss?cve=CVE-2015-3306
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3306
782781		https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782781
CVE-2015-3306	Exploit	https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/49908.py
CVE-2015-3306;OSVDB-120834	Exploit	http://bugs.proftpd.org/show_bug.cgi?id=4169
CVE-2015-3306;OSVDB-120834	Exploit	https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/36742.txt
CVE-2015-3306;OSVDB-120834	Exploit	https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/36803.py
CVE-2015-3306;OSVDB-120834	Exploit	https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/37262.rb

Data source	Exploit-DB
Date added	April 14, 2015
Description	ProFTPd 1.3.5 - File Copy
Ransomware campaign use	Known
Source publication date	April 13, 2015
Exploit type	remote
Platform	linux
Source update date	Oct. 10, 2016
Source URL	http://bugs.proftpd.org/show_bug.cgi?id=4169

Data source	Metasploit
Description	This module exploits the SITE CPFR/CPTO mod_copy commands in ProFTPD version 1.3.5. Any unauthenticated client can leverage these commands to copy files from any part of the filesystem to a chosen destination. The copy commands are executed with the rights of the ProFTPD service, which by default runs under the privileges of the 'nobody' user. By using /proc/self/cmdline to copy a PHP payload to the website directory, PHP remote code execution is made possible.
Note	Stability: - crash-safe Reliability: - repeatable-session SideEffects: - artifacts-on-disk - ioc-in-logs
Ransomware campaign use	Unknown
Source publication date	April 22, 2015
Platform	Unix
Source URL	https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/unix/ftp/proftpd_modcopy_exec.rb

There are no known vectors.

Percentile	0.99891
EPSS Score	0.94051
Published At	July 31, 2025, 12:55 p.m.

Date	Actor	Action	Source	VulnerableCode Version
2025-07-31T09:55:45.969662+00:00	Debian Oval Importer	Import	https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2	37.0.0