Actively exploited vulnerabilities affecting Wing FTP Server products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2025-47813https://wildfortech.com/security#CVE-2025-47813Wing FTP Server leaks sensitive information through error messages triggered by sending an oversized value in the UID cookie. Attackers can exploit this without needing valid credentials, potentially harvesting internal details — such as file paths, software versions, or configuration data — that help them map the environment and plan deeper attacks. Because this is an information disclosure flaw in a widely used FTP server product, it lowers the bar for follow-on compromise and is now tracked as an actively exploited vulnerability by CISA.Mon, 16 Mar 2026 00:00:00 GMTWing FTP ServerWing FTP Serverhttps://wildfortech.com/security#CVE-2025-47812https://wildfortech.com/security#CVE-2025-47812Wing FTP Server fails to properly handle null bytes in user session files, allowing an attacker to inject arbitrary Lua code into those files. Because the FTP service typically runs as root on Linux or SYSTEM on Windows, successful exploitation gives an attacker full system-level command execution — effectively complete control of the host. Any organization running Wing FTP Server should treat this as a critical-severity, actively tracked vulnerability requiring immediate attention.Mon, 14 Jul 2025 00:00:00 GMTWing FTP ServerWing FTP Server