Wftpserver Wing_ftp_server
20 CVEs affecting Wftpserver Wing_ftp_server. Latest disclosed: 2026-05-12. Critical: 1, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-47812 | Critical | 10.0 | 2025-07-10 | In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session… |
CVE-2020-37032 | High | 8.8 | 2026-01-30 | Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. A… |
CVE-2019-25267 | High | 7.8 | 2026-02-05 | Wing FTP Server 6.0.7 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system pr… |
CVE-2020-9470 | High | 7.8 | 2020-03-07 | An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling session cookies, a local user may view the con… |
CVE-2020-8635 | High | 7.8 | 2020-03-07 | Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to… |
CVE-2020-8634 | High | 7.8 | 2020-03-07 | Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, resulting in files… |
CVE-2026-44403 | High | 7.2 | 2026-05-12 | Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated adm… |
CVE-2025-5196 | Medium | 6.6 | 2025-05-26 | A vulnerability has been found in Wing FTP Server up to 7.4.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the com… |
CVE-2023-37879 | Medium | 6.5 | 2023-09-12 | Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: <= 7.2.0. |
CVE-2023-37878 | Medium | 6.1 | 2023-09-12 | Insecure default permissions in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0. |
CVE-2020-27735 | Medium | 6.1 | 2021-01-26 | An XSS issue was discovered in Wing FTP 6.4.4. An arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of (s… |
CVE-2023-37881 | Medium | 4.9 | 2023-09-12 | Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0. |
CVE-2020-37079 | Medium | 4.3 | 2026-02-07 | Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administration interface that allows attackers to… |
CVE-2025-47813 | Medium | 4.3 | 2025-07-10 | loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie. |
CVE-2025-47811 | Medium | 4.1 | 2025-07-10 | In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application i… |
CVE-2025-27889 | Low | 3.4 | 2025-07-10 | Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary li… |
CVE-2023-37875 | Low | 3.0 | 2023-09-12 | Improper encoding or escaping of output in Wing FTP Server (User Web Client) allows Cross-Site Scripting (XSS).This issue affects Wing FTP Server: <= 7.2.0. |
CVE-2015-4108 | | 2015-06-10 | Multiple cross-site request forgery (CSRF) vulnerabilities in Wing FTP Server before 4.4.7 allow remote attackers to hijack the authentication of administrator… | |
CVE-2012-4729 | | 2012-10-26 | Wing FTP Server before 4.1.1 allows remote authenticated users to cause a denial of service (daemon crash) via two zip commands. | |
CVE-2010-2428 | | 2010-06-24 | Cross-site scripting (XSS) vulnerability in admin_loginok.html in the Administrator web interface in Wing FTP Server for Windows 3.5.0 and earlier allows remot… |