WF
Product
Wing FTP Server
On CISA KEVExploited in the wild
20
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 1High 10Medium 5Low 1
Watch
Add Wing FTP Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-47812 In wildKEV | 10.0 | Jul 10 | Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability Affected: before 7.4.4 |
| CVE-2025-47813 In wildKEV | 4.3 | Jul 10 | Wing FTP Server Information Disclosure Vulnerability Affected: before 7.4.4 |
| CVE-2020-37032 | 8.8 | Jan 30 | Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands Affected: 6.3.8 |
| CVE-2025-27889 | 8.8 | Jul 10 | Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link Affected: before 7.4.4 |
| CVE-2023-37881 | 8.8 | Sep 12 | Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0 Affected: through 7.2.0 |
| CVE-2023-37878 | 8.8 | Sep 12 | Insecure default permissions in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0 Affected: through 7.2.0 |
| CVE-2019-25267 | 7.8 | Feb 5 | Wing FTP Server 6.0.7 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges Affected: 6.0.7 |
| CVE-2020-9470 | 7.8 | Mar 7 | An issue was discovered in Wing FTP Server 6.2.5 before February 2020 Affected: through 6.2.5 |
| CVE-2020-8635 | 7.8 | Mar 7 | Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files Affected: 6.2.3; 6.2.3; 6.2.3 |
| CVE-2020-8634 | 7.8 | Mar 7 | Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, resulting in files being saved with… Affected: 6.2.3; 6.2.3; 6.2.3 |
| CVE-2023-37879 | 7.5 | Sep 12 | Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: <= 7.2.0 Affected: through 7.2.0 |
| CVE-2026-44403 | 7.2 | May 12 | Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization Affected: before 8.1.3 |
| CVE-2025-47811 | 6.6 | Jul 10 | In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default Affected: before 7.4.4 |
| CVE-2025-5196 | 6.6 | May 26 | A vulnerability has been found in Wing FTP Server up to 7.4.3 and classified as critical Affected: before 7.4.4 |
| CVE-2020-27735 | 6.1 | Jan 26 | An XSS issue was discovered in Wing FTP 6.4.4 Affected: 6.4.4 |
| CVE-2023-37875 | 5.4 | Sep 12 | Improper encoding or escaping of output in Wing FTP Server (User Web Client) allows Cross-Site Scripting (XSS).This issue affects Wing FTP Server: <= 7.2.0 Affected: through 7.2.0 |
| CVE-2020-37079 | 3.5 | Feb 7 | Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administration interface that allows attackers to delete admin users Affected: before 6.2.7 |
| CVE-2015-4108 | – | Jun 10 | Multiple cross-site request forgery (CSRF) vulnerabilities in Wing FTP Server before 4.4.7 allow remote attackers to hijack the authentication of administrators for requests that… Affected: through 4.4.6 |
| CVE-2012-4729 | – | Oct 26 | Wing FTP Server before 4.1.1 allows remote authenticated users to cause a denial of service (daemon crash) via two zip commands Affected: through 4.0.9; 1.1; 1.2; 1.3; 1.4; 1.5; +34 more |
| CVE-2010-2428 | – | Jun 24 | Cross-site scripting (XSS) vulnerability in admin_loginok.html in the Administrator web interface in Wing FTP Server for Windows 3.5.0 and earlier allows remote attackers to… Affected: through 3.5.0; 1.1; 1.2; 1.3; 1.4; 1.5; +19 more |
Showing 20