https://poc.intelseclab.com/tags/ftp-server/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-47812-wingftp-null-byte-lua-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-47812-wingftp-null-byte-lua-rce/Critical severity (CVSS 10) — web · CVE-2025-47812. Status: Weaponized. Affects: Wing FTP Server, web administration/login interface (loginok.html, session mechanism). Tags: wingftp, ftp-server, null-byte-injection, lua-injection, unauthenticated-rce, session-file, cwe-94, cwe-158, python.webCriticalwingftpftp-servernull-byte-injectionlua-injectionunauthenticated-rcesession-filecwe-94cwe-158pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54309-crushftp-as2-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54309-crushftp-as2-auth-bypass/Critical severity (CVSS 9) — web · CVE-2025-54309. Status: Patched. Affects: CrushFTP server, AS2 (Applicability Statement 2) authentication module / web admin interface. Tags: crushftp, as2, authentication-bypass, cwe-287, cwe-306, cwe-807, session-hijacking, shell, ftp-server.webCriticalcrushftpas2authentication-bypasscwe-287cwe-306cwe-807session-hijackingshellftp-server