peter bassill · operator
$ cve CVE-2025-47813 JSON

CVE-2025-47813 KEV

4.3
MEDIUM · CVSS 3.1 · EPSS 63% (pctl 99)

Patch first

On CISA KEV — known exploited in the wild, due 2026-03-30.

Description

loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.

Scoring

CVSS4.3 (MEDIUM, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS62.97% — more likely to be exploited than 99% of all CVEs
WeaknessCWE-209
On CISA KEVyes — remediate by 2026-03-30
Public exploitnone known
Published2025-07-10
Last modified2026-06-17

CISA KEV

NameWing FTP Server Information Disclosure Vulnerability
Added2026-03-16
Due2026-03-30
Vendor / productWing FTP Server / Wing FTP Server
Ransomware usenone reported

Affected (1)

VendorProduct
wftpserverwing ftp server

References

→ the Explorer  ·  watch your stack  ·  NVD