Exploit_CVE-2025-47812

kitploit · 2026-09-06

Description

Unauthenticated RCE in Wing FTP Server 7.4.3.

Entry point

Parameterusername · request body

Pathloginok.html

NULL-byte truncation allows bypassing authentication prefix and injecting Lua code into execution context (RCE).

Affected Wftpserver Wing Ftp Server versions

Wftpserver Wing Ftp Server< 7.4.4

All known vulnerabilities by product

Wing Ftp Server

CVSS 10.0 for CVE-2025-47812

10.0

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:CHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

92.8%higher than 99.8% of all CVEs

Updated 2026-08-31

CVE Information

CVE-2025-47812

Exploit Details

Modified:2026-09-06 16:36

Last Seen:2026-09-06 18:17

Reporter:KitPloit

Other exploits for CVE-2025-47812

CVE-2025-47812

2026-09-06 KitPloitKITPLOIT

CVE-2025-47812

2026-09-06 KitPloitKITPLOIT

CVE-2025-47812-Research

2026-09-06 KitPloitKITPLOIT

CVE-2025-47812

2026-09-06 KitPloitKITPLOIT

WingFTP-CVE-2025-47812-illdeed

2026-09-06 KitPloitKITPLOIT

Blackash-CVE-2025-47812

2026-09-06 KitPloitKITPLOIT

CVE-2025-47812

2026-09-06 KitPloitKITPLOIT

CVE-2025-47812

2026-09-06 KitPloitKITPLOIT

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-H3XPLOR-EXPLOIT_CVE-2025-47812
# Wing_FTP_Server_7.4.3-Unauthenticated_RCE

Exploit Code

Share

Share on social media: