CVE-2025-47812

CVE-2025-47812 – Wing FTP Server RCE via Lua Injection Author: 0xgh057r3c0n 🧠 Description This exploit leverages a Lua injection vulnerability in Wing FTP Server 's login handler loginok.html to execute arbitrary operating system commands or gain a reverse shell. It abuses unsanitized Lua code...

Wing FTP Server CVE-2025-47812 unauth Lua RCE

CVE-2025-47812 Wing FTP = 7.4.3: NULL-byte truncation in loginok.html breaks out of the per-session Lua username string and injects io.popen when dir.html loads the session. Works with anonymous login when enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Wing FTP Server CVE-2025-47812...

Wing FTP Server UID Disclosure

The vulnerability of the Wing FTP server is related to improper checking of the value of the session cookie file UID at the /loginok.html endpoint. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose sensitive information...

CVE-2025-47813: Generation of Error Message Containing Sensitive Information

loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie...