Wing FTP Server vulnerabilities

20 known vulnerabilities, 2 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Exploited Wing FTP Server vulnerabilities

CVE-2025-47813 — Wing FTP Server Information Disclosure Vulnerability
CVE-2025-47812 — Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability

CVE-2026-44403 — Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization (CVSS 7.2)
CVE-2020-37079 — Wing FTP Server < 6.2.7 - Cross-site Request Forgery (CVSS 3.5)
CVE-2019-25267 — Wing FTP Server 6.0.7 - Unquoted Service Path (CVSS 7.8)
CVE-2020-37032 — Wing FTP Server 6.3.8 - Remote Code Execution (CVSS 8.8)
CVE-2025-47813 — Wing FTP Server Information Disclosure Vulnerability (CVSS 4.3) — exploited
CVE-2025-47812 — Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability (CVSS 10.0) — exploited
CVE-2025-47811 — (CVSS 6.6)
CVE-2025-27889 — (CVSS 8.8)
CVE-2025-5196 — Wing FTP Server Lua Admin Console unnecessary privileges (CVSS 6.6)
CVE-2023-37881 — Weak Access Control between Domains in Wing FTP Server <= 7.2.0 (CVSS 8.8)
CVE-2023-37879 — Exposed Session Variable in Wing FTP Server <= 7.2.0 (CVSS 7.5)
CVE-2023-37878 — Insecure Default Permissions in Wing FTP Server <= 7.2.0 (CVSS 8.8)
CVE-2023-37875 — Cross-Site Scripting Vulnerability in Wing FTP Server <= 7.2.0 (CVSS 5.4)
CVE-2020-27735 — (CVSS 6.1)
CVE-2020-9470 — (CVSS 7.8)
CVE-2020-8635 — (CVSS 7.8)
CVE-2020-8634 — (CVSS 7.8)
CVE-2015-4108 — (CVSS 6.8)
CVE-2012-4729 — (CVSS 6.8)
CVE-2010-2428 — (CVSS 4.3)