Vulnerability · Published Jan 30, 2026 · Assigned by VulnCheck
CVE-2020-37032Wing FTP Server 6.3.8 - Remote Code Execution
High 8.8
In plain English
A high-severity OS command injection in Wing FTP Server from Wing FTP Server. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.2%top 30.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attackers can leverage the console to send POST requests with malicious commands that trigger operating system execution through the os.execute() function.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Wing FTP Server | Wing FTP Server | 6.3.8 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-48676 exploit
- Wing FTP Server Official Homepage product
- VulnCheck Advisory: Wing FTP Server 6.3.8 - Remote Code Execution third-party-advisory