Russian Vulnerability Scanner Database

Back to List

CVE-2025-47812

Scores

EPSS

0.925high92.5%
0%20%40%60%80%100%

Percentile: 92.5%

CVSS

10.0critical3.x
0246810

CVSS Score: 10.0/10

All CVSS Scores

CVSS 3.x
10.0

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle ‘\0’ bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

nvd

CWEs

CWE-158

Related Vulnerabilities

BDU:2025-08471

Exploits

Exploit ID: CVE-2025-47812

Source: cisa

URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit ID: 52347

Source: exploitdb

URL: https://www.exploit-db.com/exploits/52347

Vulnerable Software (1)

Type: Configuration

Vendor: *

Product: wing_ftp_server

Operating System: * * *

Trait: 
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*",      "versionEndExcluding": "7.4.4",      "vulnerable": true    }  ],  "operator": "OR"}

Source: nvd

End of list