CVE-2020-37079

🔶 medium

Summary

Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administration interface that allows attackers to delete admin users. Attackers can craft a malicious HTML page with a hidden form to submit a request that deletes the administrative user account without proper authorization.

CVSS Score

4.3

Medium

EPSS Score

0.0

Exploit Probability

Published Date

2026-02-07

First Seen: 2026-02-07

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 5.4% of all 326,604 vulnerabilities in our database.

#308,897

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Feb 17, 2026

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Dhiraj Mishra

SSVC data provided by CISA

Last Modified 2026-02-18

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVSS Vector 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE IDs (Weakness Types)

CWE-352

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
wftpserver	wing_ftp_server	Affected	< 6.2.7

🔗 References 4

https://www.exploit-db.com/exploits/48200

Exploit Third Party Advisory VDB Entry

https://www.vulncheck.com/advisories/wing-ftp-server...

Third Party Advisory

https://www.wftpserver.com

Product

https://www.wftpserver.com/serverhistory.htm

Release Notes

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-44403	⚠️ high	7.2	0.1	Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization ...	2026-05-12
CVE-2019-25267	⚠️ high	7.8	0.0	Wing FTP Server 6.0.7 contains an unquoted service path vulnerability that allows local attackers to potentially execute...	2026-02-05
CVE-2020-37032	⚠️ high	8.8	0.4	Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authentica...	2026-01-30
CVE-2025-27889	ℹ️ low	3.4	0.0	Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint...	2025-07-10
CVE-2025-47811	🔶 medium	4.1	0.1	In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or S...	2025-07-10
CVE-2025-47812	⛔ critical	10.0	92.5	In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection o...	2025-07-10

These CVEs affect the same products