Vulnerabilidades de Wing FTP Server
CVEs publicadas que afetam produtos de Wing FTP Server: 3 registro(s), com severidade, exploração e correções.
CVE-2026-44403
Alta · 7.2
Exploit público CWE-94 12/05/2026
Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization
Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session values into Lua source code without proper escaping of closing delimiters, causing the injected code to be executed when the poisoned session is loaded via loadfile().
CVE-2020-37079
Baixa · 3.5
CWE-352 06/02/2026
Wing FTP Server < 6.2.7 - Cross-site Request Forgery
Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administration interface that allows attackers to delete admin users. Attackers can craft a malicious HTML page with a hidden form to submit a request that deletes the administrative user account without proper authorization.
CVE-2020-37032
Alta · 8.8
CWE-78 30/01/2026
Wing FTP Server 6.3.8 - Remote Code Execution
Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attackers can leverage the console to send POST requests with malicious commands that trigger operating system execution through the os.execute() function.