CVE-2025-27889CWE-15

Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary…

Low · published July 10, 2025

CVSS v3.1
3.4
EPSS
1%
Percentile
41.9
In the wild
Unconfirmed
What it is

Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker.

The record
Technical detail
CVSS v3.1
3.4 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00500 · 41.9th percentile
Weakness
CWE-15 · External Control of System or Configuration Setting
Published
2025-07-10T00:00Z
EPSS history
Timeline
  • 10 JUL 00:00Z
    Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary…
    cvelistv5