Cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*

An unauthenticated remote code execution vulnerability (CVE-2025-47812) in Wing FTP Server <= 7.4.3 allows attackers to execute arbitrary code via Lua injection into session files by leveraging a NULL byte truncation flaw in username handling.