CVE-2010-2428

Cross-site scripting (XSS) vulnerability in admin_loginok.html in the Administrator web interface in Wing FTP Server for Windows 3.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted POST request.

Published: Jun 24, 2010
Updated: Nov 9, 2025
CVE: CVE-2010-2428
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
wftpserver / wing_ftp_server	-	3.5.0.x
wftpserver / wing_ftp_server	1.1	1.1.x
wftpserver / wing_ftp_server	1.2	1.2.x
wftpserver / wing_ftp_server	1.3	1.3.x
wftpserver / wing_ftp_server	1.4	1.4.x
wftpserver / wing_ftp_server	1.5	1.5.x
wftpserver / wing_ftp_server	1.6	1.6.x
wftpserver / wing_ftp_server	2.0	2.0.x
wftpserver / wing_ftp_server	2.1	2.1.x
wftpserver / wing_ftp_server	2.3	2.3.x
wftpserver / wing_ftp_server	2.4	2.4.x
wftpserver / wing_ftp_server	3.0.0	3.0.0.x
wftpserver / wing_ftp_server	3.1.0	3.1.0.x
wftpserver / wing_ftp_server	3.1.2	3.1.2.x
wftpserver / wing_ftp_server	3.2.0	3.2.0.x
wftpserver / wing_ftp_server	3.2.4	3.2.4.x
wftpserver / wing_ftp_server	3.2.8	3.2.8.x
wftpserver / wing_ftp_server	3.3.0	3.3.0.x
wftpserver / wing_ftp_server	3.3.4	3.3.4.x
wftpserver / wing_ftp_server	3.3.5	3.3.5.x
wftpserver / wing_ftp_server	3.4.0	3.4.0.x
wftpserver / wing_ftp_server	3.4.1	3.4.1.x
wftpserver / wing_ftp_server	3.4.2	3.4.2.x
wftpserver / wing_ftp_server	3.4.3	3.4.3.x
wftpserver / wing_ftp_server	3.4.5	3.4.5.x

Vulnerability Database

310,057

CVE-2010-2428

Deep Security Visibility Without the Complexity