Michal, iFTPAddU is for adding users, and iFTPAddH is for adding virtual hosts. These sound like administator-level controls. Presumably, the same admin already had the access to install WS_FTP in the first place. So, it doesn't seem like these cross any privilege boundaries, so they don't sound like vulnerabilities. Am I missing something here? - Steve