Wing FTP Server vulnerabilities

Products

• Wing FTP Server 7

Latest Wing FTP Server CVEs

Newest publication first

1. CVE-2026-44403 Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization

   Published 2026-05-12

   High·CVSS 8.6 EPSS 2.6%

   Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe seriali...

2. CVE-2020-37079 Wing FTP Server < 6.2.7 - Cross-site Request Forgery

   Published 2026-02-06

   Medium·CVSS 5.1 EPSS 0.19%

   Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administration interface that allows attackers to delete admin users. Attackers can craft a malicious HTML page with a hidden form to submit a request that deletes the adm...

3. CVE-2020-37032 Wing FTP Server 6.3.8 - Remote Code Execution

   Published 2026-01-30

   High·CVSS 8.6 EPSS 1.2%

   Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attackers can leverage the console to send POST requests with malicious commands that trigger operating system execution t...

4. CVE-2023-37875 Cross-Site Scripting Vulnerability in Wing FTP Server <= 7.2.0

   Published 2023-09-12

   Medium·CVSS 5.4 EPSS 0.29%

   Improper encoding or escaping of output in Wing FTP Server (User Web Client) allows Cross-Site Scripting (XSS).This issue affects Wing FTP Server: <= 7.2.0.

5. CVE-2023-37878 Insecure Default Permissions in Wing FTP Server <= 7.2.0

   Published 2023-09-12

   High·CVSS 8.8 EPSS 0.51%

   Insecure default permissions in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0.

6. CVE-2023-37879 Exposed Session Variable in Wing FTP Server <= 7.2.0

   Published 2023-09-12

   High·CVSS 7.5 EPSS 0.53%

   Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: <= 7.2.0.

7. CVE-2023-37881 Weak Access Control between Domains in Wing FTP Server <= 7.2.0

   Published 2023-09-12

   High·CVSS 8.8 EPSS 0.56%

   Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.