Vulnerability · Published Jan 20, 2021 · Assigned by mitre

CVE-2020-27735

Medium 6.1

In plain English

A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.8% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)5.8%top 6.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

An XSS issue was discovered in Wing FTP 6.4.4. An arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of (sandboxed) arbitrary HTML and JavaScript in the user's browser.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.wftpserver.com/serverhistory.htm x_refsource_MISC
https://wshenk.blogspot.com/2021/01/xss-in-wing-ftps-web-interface-cve-2020.html x_refsource_MISC