{"affected":[{"defaultStatus":"unaffected","product":"Wing FTP Server","source":"CNA: VulnCheck","vendor":"Wing FTP Software","versions":[{"lessThan":"8.2.6","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-120491","cwes":["CWE-79"],"description":"Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admin_get_lastconn.html XML to forge a connection id, which executes in administrators' browsers when admin_connection_list.html auto-refreshes, enabling Lua console abuse.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.1,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0"},{"score":5.4,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793634536716,"publishedAt":1793629760004,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory","release-notes"],"url":"https://www.wftpserver.com/serverhistory.htm"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/wing-ftp-server-before-8.2.6-stored-xss-via-nowpath-in-legacy-activity-page"}],"remediation":[],"revision":"de84710c475e2d6ccf26723c98616d926c867c90de23f373880ba1738c09c4de","sources":[{"modifiedAt":1793634536716,"name":"CNA: VulnCheck","retrievedAt":1793635736627,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120491"}],"ssvc":{"assessedAt":1793634501503,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page","updatedAt":1793635736627}