482 matches found
CVE-2020-8635
这是什么 Wing FTP Server 6.2.3 - 权限提升 利用 简介 Wing FTP Server v6.2.3 在 Linux、macOS 和 Solaris 平台上对安装目录和配置文件设置了不安全的权限。这允许本地用户随意创建具有完全权限的 FTP 用户，并通过修改系统文件来提升操作系统内的权限。 测试环境 Ubuntu 18.04, Kali Linux 4, MacOS Catalina, Solaris 11.4 x86 利用 python3 cve-2020-8635.py -t 192.168.0.2:2222 -u lowleveluser -p demo...
CVE-2025-47812-Wing-FTP-Server-7.4.3-Unauthenticated-RCE-PoC
CVE-2025-47812 — Wing FTP Server Vulnerabilidad de ejecución remota de código no autenticada en Wing FTP Server = 7.4.3. Un byte NULL inyectado en el parámetro username durante el inicio de sesión provoca que se escriba código Lua en el archivo de sesión. Cuando se accede a /dir.html con la cooki...
Wing FTP Server <= 7.4.3 - Remote Code Execution
Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution RCE flaw CVE-2025-47812. The vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection into session files. These injected sessio...
CVE-2025-471812-POC
/ | / | / / | / / / |/ // / / / / / / &password= 2. El servidor autentica "anonymous" truncado en el byte nulo...
CVE-2025-47812-PoC
CVE-2025-47812 — Ejecución Remota de Código RCE en Wing FTP Server Resumen Campo| Valor ---|--- CVE| CVE-2025-47812 Afectado| Wing FTP Server 7.4.4 Tipo| Ejecución Remota de Código sin Autenticación Puntuación CVSS| 10.0 Crítico Corregido en| Wing FTP Server 7.4.4 Cómo funciona La vulnerabilidad...
Security update for libsodium
This update for libsodium fixes the following issues: Update to 1.0.22 jscPED-16890: Post-quantum key encapsulation is now available. ML-KEM768, the NIST-standardized lattice-based KEM, is accessible through the cryptokemmlkem768 functions. X-Wing, a hybrid KEM combining ML-KEM768 with X25519 for...
SUSE-SU-2026:4368-1 Security update for libsodium
This update for libsodium fixes the following issues: Update to 1.0.22 jscPED-16890: Post-quantum key encapsulation is now available. ML-KEM768, the NIST-standardized lattice-based KEM, is accessible through the cryptokemmlkem768 functions. X-Wing, a hybrid KEM combining ML-KEM768 with X25519 for...
📄 Wing FTP Server 8.1.2 Remote Code Execution via Session Poisoning
This proof of concept remote code execution exploit abuses a flaw in how Wing FTP Server handles admin session serialization, specifically the mydirectory basefolder field. Version 8.1.2 is affected...
📄 Wing FTP Server 8.1.2 Authenticated Remote Code Execution
Wing FTP Server versions prior to 8.1.3 allows authenticated administrators to execute arbitrary Lua code on the server. ================================================================================================================================== | Title : Wing FTP Server 8.1.2 - Authenticat...
CVE-2026-44403
Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session...
📄 Wing FTP Server 8.1.3 Remote Code Execution
Wing FTP Server version 8.1.2 contains a remote code execution vulnerability in the session serialization mechanism. An authenticated administrator can inject arbitrary Lua code through the domain admin mydirectory basefolder field, which gets executed server-side via loadfile. Exploit Title: Win...
Wing FTP Server 8.1.3 - Authenticated Remote Code Execution
Exploit Title: Wing FTP Server 8.1.3 - Authenticated Remote Code Execution Date: 12.05.2026 Exploit Author: Ünsal Furkan Harani Vendor Homepage: https://www.wftpserver.com/ Software Link: https://www.wftpserver.com/download.htm Version: v8.1.2 Tested on: Wing FTP Server = 8.1.2, fixed in 8.1.3 CV...
Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server
CVE-2025-47812 — Wing FTP Server Unauth RCE rewrite Python...
Exploit for CVE-2026-44403
Wing FTP Server v8.1.2 contains a Remote Code Execution RCE vu...
EUVD-2026-29848
Wing FTP Server 8.1.2 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session values...
CVE-2026-44403
Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session...
CVE-2026-44403
Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session...
CVE-2026-44403 Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization
Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session...
CVE-2026-44403
Wing FTP Server 8.1.2 is affected: an authenticated remote code execution due to unsafe session serialization that injects Lua via the domain admin mydirectory field, leading to code execution when a poisoned session is loaded with loadfile(). Root cause: unsafe serialization of session values in...
CVE-2026-44403 Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization
Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session...