CVE-2025-5196

A vulnerability has been found in Wing FTP Server up to 7.4.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Lua Admin Console. The manipulation leads to execution with unnecessary privileges. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 7.4.4 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "[W]e do not consider it as a security vulnerability, because the system admin in WingFTP has full permissions [...], but you can suggest the user run WingFTP service as Normal User rather than SYSTEM/Root, it will be safer."

• CWE-250

• https://github.com/Nouvexr/Wing-FTP-Server-7.4.4-RCE-Authenticated/blob/main/poc.txtExploit
• https://vuldb.com/?ctiid.310279Permissions Required, VDB Entry
• https://vuldb.com/?id.310279Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.584253Exploit, VDB Entry
• https://www.wftpserver.com/serverhistory.htmBroken Link
• https://github.com/Nouvexr/Wing-FTP-Server-7.4.4-RCE-Authenticated/blob/main/poc.txtExploit

Published

May 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5192A missing authentication for critical function vulnerability…7.5
• CVE-2025-5194The WP Map Block WordPress plugin before 2.0.3 does not val…4.8
• CVE-2025-5195An issue has been discovered in GitLab CE/EE affecting all v…4.3
• CVE-2025-51951andisearch v0.5.249 was discovered to contain a cross-site s…6.1
• CVE-2025-51954playground.electronhub.ai v1.1.9 was discovered to contain a…6.1
• CVE-2025-51958aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allo…9.8
• CVE-2025-51962A HTML Injection vulnerability in the comment section of the…6.1
• CVE-2025-51965OURPHP thru 8.6.1 is vulnerable to Cross-Site Scripting (XSS…6.1
• CVE-2025-51966A cross-site scripting (XSS) vulnerability exists in the PDF…6.1
• CVE-2025-51967A Reflected Cross-site Scripting (XSS) vulnerability exists …6.1
• CVE-2025-51968A SQL Injection vulnerability exists in the action.php file …6.5
• CVE-2025-51969A SQL Injection vulnerability exists in the product.php page…6.5