FTPBuster

FTPBuster FTPBuster is a powerful command-line brute-forcing tool designed to brute-force FTP, SFTP, and explicit FTPS servers by performing dictionary-based attacks. It is intended for ethical hacking and penetration testing Features Brute-force support for FTP , SFTP , and explicit FTPS AUTH TL...

Brosec

Overview tl;dr Brosec is a terminal based reference utility designed to help us infosec bros and broettes with useful yet sometimes complex payloads and commands that are often used during work as infosec practitioners. An example of one of Brosec's most popular use cases is the ability to genera...

Wing FTP Server <= 7.4.3 - Path Disclosure via Overlong UID Cookie

Wing FTP Server versions prior to 7.4.4 are vulnerable to an authenticated information disclosure vulnerability CVE-2025-47813. The vulnerability occurs due to improper validation of the 'UID' session cookie in the /loginok.html endpoint. Supplying an overlong UID value causes the server to respo...

Wing FTP Server <= 7.4.3 - Remote Code Execution

Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution RCE flaw CVE-2025-47812. The vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection into session files. These injected sessio...

CVE-2026-120491

Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admingetlastconn.html XML to...

CVE-2026-120491 Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page

Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admingetlastconn.html XML to...

CVE-2026-120491

Wing FTP Server versions prior to 8.2.6 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The issue arises when authenticated web-client users submit a crafted nowpath parameter to the webclient/makethumb.html page. An attacker can break out of the directory CDATA section in th...

EUVD-2026-115225

Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admingetlastconn.html XML to...

CVE-2026-120491 Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page

Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admingetlastconn.html XML to...

PT-2026-135481

Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admin get lastconn.html XML t...

CVE-2026-120491: Wing FTP Software Wing FTP Server: Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client…

Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admingetlastconn.html XML to...

CVE-2025-47812-poC

CVE-2025-47812-poC Simple exploit for Wing FTP Server RCE CVE-2025-47812 to run commands and get a reverse shell. For educational use only. Vulnerability Details This security vulnerability was publicly disclosed and detailed by RCESecurity...

CVE-2025-47812

CVE-2025-47812 – Wing FTP Server RCE via Lua Injection Author: 0xgh057r3c0n 🧠 Description This exploit leverages a Lua injection vulnerability in Wing FTP Server 's login handler loginok.html to execute arbitrary operating system commands or gain a reverse shell. It abuses unsanitized Lua code...

CVE-2025-47812-poc

CVE-2025-47812 Wing FTP Server Remote Code Execution RCE Exploit CVE-2025-47812 📌 Credit : Vulnerability discovered by Julien @MrTuxracer. This PoC implementation is based on their original research. This repository hosts a Python exploit for the Wing FTP Server Remote Code Execution RCE...

WingFTP-CVE-2025-47812-illdeed

CVE-2025-47812 - Wing FTP Server RCE Exploit This repository provides a proof-of-concept exploit for CVE-2025-47812 , a remote command execution RCE vulnerability in Wing FTP Server. An attacker can inject and execute arbitrary Lua-based system commands by abusing the username parameter during...

CVE-2025-47812

CVE-2025-47812 Improper input validation led to Remote Code Execution to full system compromise 📘 Introduction: Julien Ahrens from RCE Security discovered a critical security vulnerability impacting WingFTP. Tracked as CVE-2025-47812, the vulnerability has a CVSS score of 10. Successful...

CVE-2025-5548

CVE-2025-5548 Repository documenting the vulnerability CVE-2025-5548 , including environment setup and step-by-step exploitation. Structure 1. Installation — Required tools Python, IDA, Immunity, Mona, Free Float FTP Server, Ncat. 2. Exploitation — IDA analysis and step-by-step overflow exploit;...

CVE-2024-4040

CVE-2024-4040 Introduction Recently, I came across this vulnerability and found it quite interesting. I read the following articles and wrote a brief exploit. https://y4tacker.github.io/2023/12/10/year/2023/12/CrushFTP-Unauthenticated-Remote-Code-Execution-CVE-2023-43177/...

CVE-2020-8635

What's this Wing FTP Server 6.2.3 - Privilege Escalation Exploit Introduction Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to arbitrarily create FTP users with full privileges, and...

CVE-2025-47812

=========================================================== CVE-2025-47812 - Wing FTP Server Remote Code Execution RCE =========================================================== Author: blindma1den Date: July 2025 Exploit Type: Remote Code Execution Unauthenticated Target: Wing FTP Server 7.4.4...