Wftpserver vulnerabilities
5 published CVEs name Wftpserver among the affected products; CISA lists 2 of them as exploited in the wild.
- Published CVEs
- 5
- Last 12 months
- 1
- Critical
- 1
- Known exploited
- 2
Critical 1High 1Medium 2Low 1Not scored 0
CVEs per yearBy the year they were published
- 20254
- 20261
Known exploitedNewest addition to KEV first
- CVE-2025-47813
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
wftpserver · Wing FTP Server
ExploitedMedium4.3 - CVE-2025-47812
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session…
wftpserver · Wing FTP Server
ExploitedCritical10.0
Newest CVEs
- CVE-2019-25267
Wing FTP Server 6.0.7 - Unquoted Service Path
Wftpserver · Wing FTP Server
High8.5 - CVE-2025-47813
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
wftpserver · Wing FTP Server
ExploitedMedium4.3 - CVE-2025-47812
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session…
wftpserver · Wing FTP Server
ExploitedCritical10.0 - CVE-2025-47811
In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application…
wftpserver · Wing FTP Server
Medium4.1 - CVE-2025-27889
Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary…
wftpserver · Wing FTP Server
Low3.4