Threat Intelligence / CVE / CVE-2025-47813

CVE-2025-47813

CISA KEV

CVSS 4.3 (MEDIUM) · EPSS 25.5% · Published 2025-07-10

loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-209

Threats tracking this CVE

Wing FTP Server RCE Exploit Chain — Lua Code Injection via NULL Byte (CVE-2025-47812 CVSS 10.0 + CVE-2025-47813) — CRITICAL

References

Full detection coverage & IOCs for threats exploiting CVE-2025-47813 are available via the Threadlinqs MCP server (Purple tier). View plans →

Markdown version · Threadlinqs Intelligence