WF
Vendor
wftpserver
22
CVEs
2
On KEV
0
New 30D
Products
WF10.0
Wing FTP Server
wftpserver
20 CVEs2 on KEV0 new
WF–
Winftp Ftp Server
Wftpserver
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-44403 | WF Wing Ftp Server Wftpserver | 7.2 | May 12 | Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization |
| CVE-2020-37079 | WF Wing Ftp Server Wftpserver | 3.5 | Feb 7 | Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administration interface that allows attackers to delete admin users |
| CVE-2019-25267 | WF Wing Ftp Server Wftpserver | 7.8 | Feb 5 | Wing FTP Server 6.0.7 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges |
| CVE-2020-37032 | WF Wing Ftp Server Wftpserver | 8.8 | Jan 30 | Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands |
| CVE-2025-47811 | WF Wing Ftp Server Wftpserver | 6.6 | Jul 10 | In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default |
| CVE-2025-27889 | WF Wing Ftp Server Wftpserver | 8.8 | Jul 10 | Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link |
| CVE-2025-47813 In wildKEV | WF Wing FTP Server wftpserver | 4.3 | Jul 10 | Wing FTP Server Information Disclosure Vulnerability |
| CVE-2025-47812 In wildKEV | WF Wing FTP Server wftpserver | 10.0 | Jul 10 | Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability |
| CVE-2025-5196 | WF Wing Ftp Server Wftpserver | 6.6 | May 26 | A vulnerability has been found in Wing FTP Server up to 7.4.3 and classified as critical |
| CVE-2023-37881 | WF Wing Ftp Server Wftpserver | 8.8 | Sep 12 | Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0 |
| CVE-2023-37879 | WF Wing Ftp Server Wftpserver | 7.5 | Sep 12 | Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: <= 7.2.0 |
| CVE-2023-37878 | WF Wing Ftp Server Wftpserver | 8.8 | Sep 12 | Insecure default permissions in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0 |
| CVE-2023-37875 | WF Wing Ftp Server Wftpserver | 5.4 | Sep 12 | Improper encoding or escaping of output in Wing FTP Server (User Web Client) allows Cross-Site Scripting (XSS).This issue affects Wing FTP Server: <= 7.2.0 |
| CVE-2020-27735 | WF Wing Ftp Server Wftpserver | 6.1 | Jan 26 | An XSS issue was discovered in Wing FTP 6.4.4 |
| CVE-2020-9470 | WF Wing Ftp Server Wftpserver | 7.8 | Mar 7 | An issue was discovered in Wing FTP Server 6.2.5 before February 2020 |
| CVE-2020-8635 | WF Wing Ftp Server Wftpserver | 7.8 | Mar 7 | Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files |
| CVE-2020-8634 | WF Wing Ftp Server Wftpserver | 7.8 | Mar 7 | Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, resulting in files being saved with… |
| CVE-2015-4108 | WF Wing Ftp Server Wftpserver | – | Jun 10 | Multiple cross-site request forgery (CSRF) vulnerabilities in Wing FTP Server before 4.4.7 allow remote attackers to hijack the authentication of administrators for requests that… |
| CVE-2012-4729 | WF Wing Ftp Server Wftpserver | – | Oct 26 | Wing FTP Server before 4.1.1 allows remote authenticated users to cause a denial of service (daemon crash) via two zip commands |
| CVE-2010-2428 | WF Wing Ftp Server Wftpserver | – | Jun 24 | Cross-site scripting (XSS) vulnerability in admin_loginok.html in the Administrator web interface in Wing FTP Server for Windows 3.5.0 and earlier allows remote attackers to… |
| CVE-2009-0351 | WF Winftp Ftp Server Wftpserver | – | Jan 29 | Stack-based buffer overflow in WFTPSRV.exe in WinFTP 2.3.0 allows remote authenticated users to execute arbitrary code via a long LIST argument beginning with an * (asterisk)… |
| CVE-2008-5666 | WF Winftp Ftp Server Wftpserver | – | Dec 19 | WinFTP FTP Server 2.3.0, when passive (aka PASV) mode is used, allows remote authenticated users to cause a denial of service via a sequence of FTP sessions that include an… |