CVE-2025-47812

🗓️ 10 Jul 2025 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 26 Media mentions👁 351 Views🌐 WEB

Critical remote code execution flaw in Wing FTP Server allows Lua code injection and system command execution

Reporter	Title	Published	Views	Family All 61
GithubExploit	Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server	2 Jul 202521:51	–	githubexploit
GithubExploit	Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server	18 Feb 202608:41	–	githubexploit
GithubExploit	Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server	1 Jul 202518:20	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Astaro Security_Gateway_Software	30 Apr 201915:15	–	githubexploit
GithubExploit	HTB-WingData-Writeup	27 Apr 202615:17	–	githubexploit
GithubExploit	Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server	1 Jul 202512:02	–	githubexploit
GithubExploit	Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server	27 Jul 202517:47	–	githubexploit
GithubExploit	Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server	7 Jul 202513:20	–	githubexploit
GithubExploit	Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server	4 Jul 202516:22	–	githubexploit
GithubExploit	Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server	22 Feb 202618:28	–	githubexploit

NVD

Vulners

CNA

Node

wftpserver wing_ftp_serverRange<7.4.4

[
  {
    "defaultStatus": "unaffected",
    "product": "Wing FTP Server",
    "vendor": "wftpserver",
    "versions": [
      {
        "lessThan": "7.4.4",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
vicarius	www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-code-execution-vulnerability-in-wing-ftp-server
wftpserver	www.wftpserver.com/
rcesecurity	www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/
vicarius	www.vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-code-execution-vulnerability-in-wing-ftp-server
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
huntress	www.huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild

Parameter	Position	Path	Description	CWE
username	request body	loginok.html	NULL-byte truncation enabling payload to reach Lua execution context through login flow (authentication bypass leading to RCE).	CWE-158

17 Jun 2026 09:28Current

8.7High risk

Vulners AI Score8.7

CVSS 3.110

EPSS0.95343

SSVC