Read the docs

Wing FTP Server

Records22All Threatist records
Exploited (KEV)2In CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

Wing FTP Server records in CISA KEV
TI-2025-30266 Wing FTP Server Information Disclosure Vulnerability Priority HIGH 79KEV 2026-03-16TI-2025-30265 Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability Priority CRITICAL 100KEV 2025-07-14

Components

Products in the NVD configurations · select one to filter the records
Wing Ftp Server 20 records CRITICAL Winftp Ftp Server 2 records MEDIUM

Records

22 records

TI-2025-30265 CVE-2025-47812 · GHSA-j4xf-75rr-vvrv

In Wing FTP Server before 7.4.4.

Priority CRITICAL 100KEV

In Wing FTP Server before 7.4.4.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.93884 Published 2025-07-10 Fixed in 7.4.4 CWE-158
TI-2025-30266 CVE-2025-47813 · GHSA-2vvg-j984-hh8p

Information disclosure through error messages in Wing FTP Server

Priority HIGH 79KEV

loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.62512 Published 2025-07-10 Fixed in 7.4.4 CWE-209
TI-2020-19167 CVE-2020-37032 · GHSA-h3x8-7gw7-p9rx

Wing FTP Server 6.3.8 - Remote Code Execution

Priority HIGH 72

Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01236 Published 2026-01-30 No fix listed CWE-78
TI-2019-15321 CVE-2019-25267 · GHSA-vw42-p2xj-xq5q

Wing FTP Server 6.0.7 - Unquoted Service Path

Priority HIGH 72

Wing FTP Server 6.0.7 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00246 Published 2026-02-04 No fix listed CWE-428
TI-2020-19214 CVE-2020-37079 · GHSA-g436-h983-ffpf

Wing FTP Server < 6.2.7 - Cross-site Request Forgery

Priority MEDIUM 62

Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administration interface that allows attackers to delete admin users.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00194 Published 2026-02-06 No fix listed CWE-352
TI-2026-32348 CVE-2026-44403 · GHSA-ffh5-r5xj-cgmg

Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization

Priority MEDIUM 44

Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain a…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.02643 Published 2026-05-12 Fixed in 8.1.3 CWE-94
TI-2023-19315 CVE-2023-37878 · GHSA-wjwx-g228-98hp

Insecure Default Permissions in Wing FTP Server <= 7.2.0

Priority MEDIUM 41

Insecure default permissions in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00514 Published 2023-09-12 No fix listed CWE-276
TI-2023-19317 CVE-2023-37881 · GHSA-wjx2-7g7g-vj3g

Weak Access Control between Domains in Wing FTP Server <= 7.2.0

Priority LOW 39

Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00558 Published 2023-09-12 No fix listed CWE-863
TI-2008-05374 CVE-2008-5666 · GHSA-wxv2-27rf-hx46

WinFTP FTP Server 2.3.0, when passive (aka PASV) mode is used, allows remote…

Priority LOW 36

WinFTP FTP Server 2.3.0, when passive (aka PASV) mode is used, allows remote authenticated users to cause a denial of service via a sequence of FTP sessions that include an invalid "NLST -1" command.

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.20591 Published 2008-12-18 No fix listed CWE-399
TI-2020-06922 CVE-2020-8634 · GHSA-h98j-87f6-38m2

Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files…

Priority LOW 34

Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, resulting in files being saved with world-readable and world-writable permission…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00426 Published 2020-03-06 No fix listed CWE-281
TI-2023-19316 CVE-2023-37879 · GHSA-gh7h-r3ff-2vq6

Exposed Session Variable in Wing FTP Server <= 7.2.0

Priority LOW 33

Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: <= 7.2.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0053 Published 2023-09-12 No fix listed CWE-922
TI-2023-19314 CVE-2023-37875 · GHSA-3jq5-7792-2mq3

Cross-Site Scripting Vulnerability in Wing FTP Server <= 7.2.0

Priority LOW 24

Improper encoding or escaping of output in Wing FTP Server (User Web Client) allows Cross-Site Scripting (XSS).This issue affects Wing FTP Server: <= 7.2.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00292 Published 2023-09-12 No fix listed CWE-116
Open these records in search →