CVE-2020-37032

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attackers can leverage the console to send POST requests with malicious commands that trigger operating system execution through the os.execute() function.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jan 30, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2020

CVE-2020-370338.2Infor Storefront B2B 1.0 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'usr_name' CVE-2020-370347.5HelloWeb 2.0 contains an arbitrary file download vulnerability that allows remote attackers to download system files by manipulating filepatCVE-2020-370358.2e-Learning PHP Script 0.1.0 contains a SQL injection vulnerability in the search functionality that allows attackers to manipulate database CVE-2020-370368.4RM Downloader 2.50.60 contains a local buffer overflow vulnerability in the 'Load' parameter that allows attackers to execute arbitrary codeCVE-2020-370377.8Avast SecureLine 5.5.522.0 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevatedCVE-2020-370387.5Code Blocks 20.03 contains a denial of service vulnerability that allows attackers to crash the application by manipulating input in the FSyCVE-2020-370397.5Frigate 2.02 contains a denial of service vulnerability that allows attackers to crash the application by sending oversized input to the comCVE-2020-37047.5u'While processing invalid connection request PDU which is nonstandard (interval or timeout is 0) from central device may lead peripheral syCVE-2020-370408.4Code Blocks 17.12 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting a malicious filCVE-2020-370417.5OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary fileCVE-2020-370428.4Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the 'Find Computer' feature that allows attackers to executeCVE-2020-370439.810-Strike Bandwidth Monitor 3.9 contains a buffer overflow vulnerability that allows attackers to bypass SafeSEH, ASLR, and DEP protections
CVE-2020-37032: High severity, CVSS 8.8 | Vulnix