Skip to main content

Wing Ftp Server EUVDEUVD-2025-21019

| CVE-2025-27889 LOW
External Control of System or Configuration Setting (CWE-15)
2025-07-10 cve@mitre.org
Information Disclosure Wing Ftp Server Wftpserver
3.4
CVSS 3.1 · NVD

Severity by source

NVD PRIMARY
3.4 LOW
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

5
Patch available
Apr 16, 2026 - 05:29 EUVD
7.4.4
EUVD ID Assigned
Mar 16, 2026 - 06:52 euvd
EUVD-2025-21019
Analysis Generated
Mar 16, 2026 - 06:52 vuln.today
PoC Detected
Jul 17, 2025 - 13:31 vuln.today
Public exploit code
CVE Published
Jul 10, 2025 - 17:15 nvd
LOW 3.4

DescriptionCVE.org

Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker.

AnalysisAI

CVE-2025-27889 is a security vulnerability (CVSS 3.4). Risk factors: public PoC available.

Technical ContextAI

Vulnerability type not specified by vendor.

RemediationAI

Monitor vendor channels for patch availability.

More in Wing Ftp Server

View all
CVE-2025-47812 CRITICAL POC
10.0 Jul 10

Wing FTP Server before 7.4.4 contains a critical remote code execution vulnerability (CVE-2025-47812, CVSS 10.0) through
CVE-2025-47813 MEDIUM POC
4.3 Jul 10

loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a

CVE-2020-37032 HIGH POC
8.8 Jan 30

Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authentica
CVE-2026-44403 HIGH POC
8.6 May 12

Authenticated remote code execution in Wing FTP Server 8.1.2 lets a domain administrator inject arbitrary Lua code by ab
CVE-2019-25267 HIGH POC
7.8 Feb 05

Wing Ftp Server versions up to 6.0.7 contains a vulnerability that allows attackers to potentially execute arbitrary cod
CVE-2020-9470 HIGH POC
7.8 Mar 07

An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Rated high severity (CVSS 7.8), this vulnerabilit
CVE-2020-8635 HIGH POC
7.8 Mar 07

Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configura
CVE-2020-8634 HIGH POC
7.8 Mar 07

Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file ma
CVE-2015-4108 MEDIUM POC
6.8 Jun 10

Multiple cross-site request forgery (CSRF) vulnerabilities in Wing FTP Server before 4.4.7 allow remote attackers to hij
CVE-2023-37881 HIGH
8.8 Sep 12

Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.2.0. Rated high severity (CVSS
CVE-2023-37878 HIGH
8.8 Sep 12

Insecure default permissions in Wing FTP Server (Admin Web Client) allows for privilege escalation.2.0. Rated high sever
CVE-2020-37079 MEDIUM POC
4.3 Feb 07

Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administrat

Same weakness CWE-15 – External Control of System or Configuration Setting

View all
CVE-2026-45087 CRITICAL POC
10.0
CVE-2024-4326 CRITICAL POC
9.8
CVE-2023-50252 CRITICAL POC
9.8
CVE-2023-46248 HIGH POC
8.8
CVE-2023-43323 MEDIUM POC
6.5
CVE-2026-87987 CRITICAL
10.0
CVE-2026-19593 CRITICAL
9.8
CVE-2026-22708 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2025-21019 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy