Threats tagged 'ghsa-76h6-gfhv-jpgq'

Wing FTP Server versions before 8.2.6 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated web-client users to inject malicious scripts via a crafted 'nowpath' parameter to the webclient/makethumb.html endpoint. Exploitation enables attackers to manipulate XML content in admin_get_lastconn.html, forging connection IDs that execute in administrators' browsers when admin_connection_list.html auto-refreshes. This can lead to abuse of the Lua console by administrators.