CVE-2023-37875
12.09.2023, 09:15
Improper encoding or escaping of output in Wing FTP Server (User Web Client) allows Cross-Site Scripting (XSS).This issue affects Wing FTP Server: <= 7.2.0.
| Vendor | Product | Version |
|---|---|---|
| wftpserver | wing_ftp_server | 𝑥 ≤ 7.2.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-116 - Improper Encoding or Escaping of OutputThe software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.