CVE-2025-27889 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary lin…
Low CVSS: 3.4

CVE-2025-27889

Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker.
Vendor
Wftpserver
Product
Wing Ftp Server
CWE
CWE-15
Yayın Tarihi
2025-07-10 17:15:46
Güncelleme
2025-07-17 13:31:12
Source Identifier
cve@mitre.org
KEV Date Added
-

Kategoriler

CWE-15 Wing Ftp Server LOW Wftpserver 2025

Referanslar

https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27889.txt https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/ https://www.wftpserver.com/wftpserver.htm https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/