https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T06:56:18.598505+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-09369 bdu:2025-09369 2026-10-06T06:56:18.664084+00:00 bdu:2025-09369 https://cve.radiocsirt.org/vuln/euvd-2026-247308 EUVD-2026-247308 2026-10-06T06:56:18.664125+00:00 EUVD-2026-247308 https://cve.radiocsirt.org/vuln/fkie_cve-2025-27889 fkie_cve-2025-27889 2026-10-06T06:56:18.664139+00:00

Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker.

 https://cve.radiocsirt.org/vuln/ghsa-vv9j-pvh3-xwg4 GHSA-vv9j-pvh3-xwg4 2026-10-06T06:56:18.664168+00:00

Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker.