PT-2026-132337

A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows...

PT-2026-132326

Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories...

PT-2026-132331

Name of the Vulnerable Software and Affected Versions Progress Software WS FTP Server versions prior to 2024.0.7 Progress Software WS FTP Server versions prior to 2025.0.4 Description Missing authorization in the administrative interface on Windows allows a delegated Host Administrator to exceed...

PT-2026-132377

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS FTP...

PT-2026-132336

Name of the Vulnerable Software and Affected Versions Progress Software WS FTP Server versions prior to 2024.0.7 Progress Software WS FTP Server versions prior to 2025.0.4 Description An OS command injection issue exists in the Windows version of the software. This flaw allows for arbitrary comma...

PT-2026-132327

Name of the Vulnerable Software and Affected Versions Progress Software WS FTP Server versions prior to 2024.0.6 Progress Software WS FTP Server versions prior to 2025.0.3 Description Improper authentication on Windows allows an unauthenticated remote attacker to access sensitive information,...

PT-2026-132333

An OS command injection vulnerability in Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations...

PT-2026-132335

Improper access control in the Web Admin console of Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts...

PT-2026-132330

Improper authentication in the Web Transfer Module of Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements...

PT-2026-132339

Improper limitation of a pathname to a restricted directory in Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory...

PT-2026-132338

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation...

PT-2026-132328

Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts...

PT-2026-132334

A path traversal vulnerability in Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution...

PT-2026-132332

A path traversal vulnerability in Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope...

PT-2026-132329

Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server...

WS FTP Server 5.0.5 Denial of Service

WS FTP Server version 5.0.5 proof of concept denial of service exploit that leverages a flaw found by Fernando Mengali in 2024. ============================================================================================================================================= | Title : WS FTP Server 5.0...

CVE-2024-9999 Multi-Factor Authentication Bypass in Progress WS_FTP Server

In WSFTP Server versions before 8.8.9 2022.0.9, an Incorrect Implementation of Authentication Algorithm in the Web Transfer Module allows users to skip the second-factor verification and log in with username and password only...

CVE-2024-7745

In WSFTP Server versions before 8.8.8 2022.0.8, a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the second-factor verification and log in with username and password only...

Progress Software WS_FTP Server Security Vulnerability

Progress Software WSFTP Server is an effective and highly manageable FTP server from Progress Software, USA. A security vulnerability exists in Progress Software WSFTP Server versions prior to 8.8.5 that stems from the presence of a cross-site scripting vulnerability...

CVE-2023-42659

In WSFTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying operating system hosting the WSFTP Serve...