CVE-2025-47813

loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.

Scoring

Severity

MEDIUM

CVSS base score

4.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS probability

62.97%

CISA KEV

Known exploited vulnerability

CWE

CWE-209

Published

2025-07-10

Last modified

2026-03-17

Affected products

• wftpserver Wing FTP Server

Weakness type

• CWE-209

Related vulnerabilities

• CVE-2026-66306 — Skype for Business Information Disclosure Vulnerability
• CVE-2026-69294 — Microsoft COM for Windows Information Disclosure Vulnerability
• CVE-2026-68886 — Windows Network Connection Broker Information Disclosure Vulnerability
• CVE-2026-67383 — Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-69684 — Windows Error Reporting Information Disclosure Vulnerability
• CVE-2026-69552 — Windows Print Spooler Components Information Disclosure Vulnerability
• CVE-2026-11873 — Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure
• CVE-2026-82739 — Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error

Markdown version · Browse all CVEs