What’s Vulnerable › Vulnerabilities

CVE-2020-37032: Wing FTP Server 6.3.8 - Remote Code Execution

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-30 · updated 2026-06-17
• Weakness: CWE-78

Description

Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attackers can leverage the console to send POST requests with malicious commands that trigger operating system execution through the os.execute() function.

Affected products

• Wing FTP Server: 6.3.8

References

• https://www.exploit-db.com/exploits/48676
• https://www.vulncheck.com/advisories/wing-ftp-server-remote-code-execution
• https://www.wftpserver.com/

Get alerted when CVE-2020-37032 or the next vulnerability affects your stack