WF
Product
Wing FTP Server
On CISA KEVExploited in the wild
20
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 1High 10Medium 5Low 1
Watch
Add Wing FTP Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-37032 | 8.8 | Jan 30 | Wing FTP Server 6.3.8 - Remote Code Execution Affected: 6.3.8 |
| CVE-2025-27889 | 8.8 | Jul 10 | Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link Affected: before 7.4.4 |
| CVE-2023-37878 | 8.8 | Sep 12 | Insecure Default Permissions in Wing FTP Server <= 7.2.0 Affected: through 7.2.0 |
| CVE-2023-37881 | 8.8 | Sep 12 | Weak Access Control between Domains in Wing FTP Server <= 7.2.0 Affected: through 7.2.0 |
| CVE-2019-25267 | 7.8 | Feb 4 | Wing FTP Server 6.0.7 - Unquoted Service Path Affected: 6.0.7 |
| CVE-2020-9470 | 7.8 | Mar 7 | An issue was discovered in Wing FTP Server 6.2.5 before February 2020 Affected: through 6.2.5 |
| CVE-2020-8635 | 7.8 | Mar 7 | Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files Affected: 6.2.3; 6.2.3; 6.2.3 |
| CVE-2020-8634 | 7.8 | Mar 7 | Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, resulting in files being saved with… Affected: 6.2.3; 6.2.3; 6.2.3 |
| CVE-2023-37879 | 7.5 | Sep 12 | Exposed Session Variable in Wing FTP Server <= 7.2.0 Affected: through 7.2.0 |
| CVE-2026-44403 | 7.2 | May 12 | Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization Affected: before 8.1.3 |
Showing 10