CVE-2020-37032: high-severity vulnerability in Wing FTP Server
Wing FTP Server 6.3.8 - Remote Code Execution
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 1.2%
exploitation probability
1.2%top 33% of all CVEs
observed exploitation
nono source reports it
Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attackers can leverage the console to send POST requests with malicious commands that trigger operating system execution through the os.execute() function.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Wing FTP Server · Wing FTP ServerRelated CVEs — Wing FTP Server
In the same product, most dangerous first.
CVE-2026-44403HIGHWing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session SerializationEPSS 2.3%CVE-2023-37881MEDIUMWeak Access Control between Domains in Wing FTP Server <= 7.2.0EPSS 0.6%CVE-2023-37879MEDIUMExposed Session Variable in Wing FTP Server <= 7.2.0EPSS 0.5%CVE-2023-37878MEDIUMInsecure Default Permissions in Wing FTP Server <= 7.2.0EPSS 0.5%CVE-2023-37875LOWCross-Site Scripting Vulnerability in Wing FTP Server <= 7.2.0EPSS 0.3%CVE-2020-37079MEDIUMWing FTP Server < 6.2.7 - Cross-site Request ForgeryEPSS 0.2%