Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2025-47812

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.

CVSS 10.0 · CriticalBuzz score 58.8KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 58.8

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 20.8 · diversity 13.0 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
20.8
7 evidence mentions in the snapshot
Diversity score
13.0
4 sources across 2 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
7 source links · newest first
  • CISA Flags Year-Old Wing FTP Vulnerability as ExploitedSecurityWeek

    Tracked as CVE-2025-47813, the flaw leads to the disclosure of the full local installation path of the application.

    newswww.securityweek.comMar 17, 2026, 10:55 AM
  • Security Affairs newsletter Round 533 by Pierluigi Paganini – INTERNATIONAL EDITIONSecurity Affairs

    A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Fortinet FortiWeb flaw CVE-2025-25257 exploited hours after PoC release Authorities released free decryptor for Phobos and […]

    newssecurityaffairs.comJul 20, 2025, 12:13 PM
  • CVE‑2025‑47812Horizon3.ai

    Wing FTP

    exploithorizon3.aiJul 17, 2025, 3:09 PM
  • U.S. CISA adds Wing FTP Server flaw to its Known Exploited Vulnerabilities catalogSecurity Affairs

    U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Wing FTP Server flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Wing FTP Server flaw, tracked as CVE-2025-47812, to its Known Exploited Vulnerabilities (KEV) catalog. Wing FTP Server is a secure and flexible file transfer solution that supports multiple protocols, including FTP, […]

    newssecurityaffairs.comJul 16, 2025, 12:01 AM
  • Wing FTP Server flaw actively exploited shortly after technical details were made publicSecurity Affairs

    Hackers exploit critical Wing FTP flaw (CVE-2025-47812) for remote code execution with root/system rights after details leaked on June 30. Threat actors are exploiting a critical flaw, tracked as CVE-2025-47812 (CVSS score of 10), in Wing FTP Server that allows remote code execution with root/system privileges. Wing FTP Server is a secure and flexible file […]

    newssecurityaffairs.comJul 13, 2025, 3:50 PM
  • Critical Wing FTP Server vulnerability exploited in the wild (CVE-2025-47812)Help Net Security

    Threat actors are actively exploiting a recently fixed remote code execution vulnerability (CVE-2025-47812) in Wing FTP Server, security researchers have warned. Wing FTP Server and CVE-2025-47812 Wing FTP Server is a commercial file transfer server solution used by businesses, MSPs and hosting providers. The software can be installed on 64-bit operating systems: Windows, Windows Server, Linux, and macOS. Administration is done via a web-based interface. Users likewise upload/download files securely via browser. CVE-2025-47812 is caused … More →

    newswww.helpnetsecurity.comJul 11, 2025, 12:29 PM
  • Critical Wing FTP Server Vulnerability ExploitedSecurityWeek

    Wing FTP Server vulnerability CVE-2025-47812 can be exploited for arbitrary command execution with root or system privileges.

    newswww.securityweek.comJul 11, 2025, 9:23 AM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2026-47778

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was identified in DefaultCer…

    CVSS 4.4 · Medium
    1 mention
  • CVE-2026-43895

    jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string…

    CVSS 4.4 · Medium
    2 mentions
  • CVE-2026-41256

    jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD.…

    CVSS 5.5 · Medium
    2 mentions
  • CVE-2026-43861

    mutt before 2.3.2 does not check for '\0' in url_pct_decode.

    CVSS 3.7 · Low
    1 mention
  • CVE-2026-43859

    mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.

    CVSS 3.7 · Low
    1 mention
  • CVE-2026-23863

    An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename…

    CVSS 6.5 · Medium
    3 mentions