Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Wing FTP Server RCE (CVE-2025-47812) - Vulnerability Database

Wing FTP Server RCE (CVE-2025-47812)

Description

Wing FTP Server is vulnerable to an unauthenticated remote code execution (RCE) due to improper handling of NULL bytes in the 'username' parameter during the login process. An attacker can inject Lua code into session files and execute it on the server.

Remediation

Upgrade to the latest version of Wing FTP

References

Technical Analysis by RCE Security
CVE-2025-47812

Related Vulnerabilities

CyberPanel RCE (CVE-2024-51567/CVE-2024-51568/CVE-2024-51378) Critical
Common tags: Code Execution Authentication Bypass Known Vulnerabilities
SharePoint "ToolShell" RCE (CVE-2025-49704/CVE-2025-49706/CVE-2025-53770/CVE-2025-53771) Critical
Common tags: Code Execution Authentication Bypass Known Vulnerabilities
Oracle Sun GlassFish/Java System Application Server Remote Authentication Bypass Vulnerability High
Common tags: Code Execution Authentication Bypass Known Vulnerabilities
Apache OFBiz RCE (CVE-2024-45195) Critical
Common tags: Code Execution Authentication Bypass Known Vulnerabilities
Apache OFBiz RCE (CVE-2024-32113/CVE-2024-36104/CVE-2024-38856) Critical
Common tags: Code Execution Authentication Bypass Known Vulnerabilities

Severity

Critical

Classification

CVE-2025-47812
CWE-158
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Tags

Code Execution
Authentication Bypass
Known Vulnerabilities