Most Exploited Internet-Facing Products

MEIFP

Back to Ranking

wftpserver

Products: Wing FTP Server

67.0

Score

3

CVEs

2

Active

1

PoC

2

KEV

#40

Rank

Period:

Product:

CVE ID	Published	CVSS	Exploit	KEV	AC	PR	Auto	Score(hover)	Affected Products	Description
CVE-2025-47811	2025-07-10	4.1v3.1	POC	—	Low	High	no	0.0	Wing FTP Server	In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application itself offers several legitimate ways to execute arbitrary system commands (i.e., through the web console or the task scheduler), and they are
CVE-2025-47812	2025-07-10	10.0v3.1	ACTIVE		Low	None	YES	40.6	Wing FTP Server	In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus
CVE-2025-47813	2025-07-10	4.3v3.1	ACTIVE		Low	Low	no	26.4	Wing FTP Server	loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.

Each CVE: 10 pts base (Active only), boosted by:

KEV×2.0AC: Low×1.2PR: None×1.3PR: Low×1.1Auto×1.3