The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Wing FTP Server to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Wing FTP Server flaw, tracked as CVE-2025-47813 (CVSS score of 4.3), to its Known Exploited Vulnerabilities (KEV) catalog.
CVE-2025-47813 is an information disclosure vulnerability affecting Wing FTP Server versions prior to 7.4.4. The issue occurs in the loginok.html page during the web authentication process.
“loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.” reads the advisory.
The flaw occurs when an attacker sends an excessively long UID cookie, triggering improper input handling that causes the server to return an error revealing the full local installation path. While it does not enable remote code execution, the leak exposes filesystem details that could aid reconnaissance and facilitate further attacks such as path-based exploitation or file inclusion attempts.
EXPLORE MORE
Endangered Missing Person Callon Baniewicz from the 9th District
The Philadelphia Police Department is seeking the public’s assistance in locating endangered…
UK ‘Rape Gang Inquiry’ presentation goes viral as survivors reveal harrowing abuse
READER DISCRETION STRONGLY ADVISED. A labeled portion of the following article, and…
Atheist AI executive helps present Pope Leo’s new encyclical
VATICAN CITY (LifeSiteNews) — This morning Pope Leo XIV made the unprecedented…
Missing Juvenile Yariel Peralta from the 12th District
The Philadelphia Police Department is seeking the public’s assistance in locating a…
Missing Juvenile Johnnyaliz Castillo-Muniz from the 25th District
Missing Juvenile Johnnyaliz Castillo-Muniz from the 25th District | Philadelphia Police Department…
Attackers exploit FortiGate devices to access sensitive network information
Attackers are exploiting FortiGate devices to breach networks and steal configuration data…
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerability by March 30, 2026.
