Wing-FTP-Server 漏洞

严重CVE-2025-478122025/07/10

Wing FTP Server <= 7.4.3 - Remote Code Execution

Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution (RCE) flaw (CVE-2025-47812). The vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection into session files. These injected session files are executed when accessing authenticated endpoints such as /dir.html, resulting in arbitrary command execution with elevated privileges. This attack is possible only when anonymous login is enabled on the server.

Wing-FTP-ServerPoC 已收录EXP 已收录

CVSS10.0EPSS 57.3%

中危CVE-2025-478132025/07/10

Wing FTP Server <= 7.4.3 - Path Disclosure via Overlong UID Cookie

Wing FTP Server versions prior to 7.4.4 are vulnerable to an authenticated information disclosure vulnerability (CVE-2025-47813). The vulnerability occurs due to improper validation of the 'UID' session cookie in the /loginok.html endpoint. Supplying an overlong UID value causes the server to respond with an error that includes the full local filesystem path. This can aid in further exploitation (e.g., CVE-2025-47812) by revealing the application’s file system layout.

Wing-FTP-ServerPoC 已收录

CVSS4.3EPSS 0.63%

高危2023/10/20

FTP Credentials Exposure

FTP credentials were detected.

Wing-FTP-ServerPoC 已收录RCE

CVSS7.5

中危CVE-2020-277352021/01/27

Wing FTP 6.4.4 - Cross-Site Scripting

Wing FTP 6.4.4 is vulnerable to cross-site scripting via its web interface because an arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of (sandboxed) arbitrary HTML and JavaScript in the user's browser.

Wing-FTP-ServerPoC 已收录

CVSS6.1EPSS 37.0%

Wing-FTP-Server

关联漏洞

Wing FTP Server <= 7.4.3 - Remote Code Execution

Wing FTP Server <= 7.4.3 - Path Disclosure via Overlong UID Cookie

FTP Credentials Exposure

Wing FTP 6.4.4 - Cross-Site Scripting