CVE-2010-2428: Cross-site scripting (XSS) vulnerability in admin_loginok.html in the Administrator web interface in Wing F...

Security readout for executives and security teams

CVE-2010-2428 is a cross-site scripting issue in the Wing FTP Server administrator web interface. If an organization still runs Wing FTP Server for Windows 3.5.0 or earlier, attackers may be able to inject script or HTML into an admin-facing page. The bundle does not provide severity scoring, confirmed exploitation, or a named fixed version. Exposure is most likely where legacy Wing FTP Server for Windows 3.5.0 or earlier is still deployed, especially if the administrator interface is reachable from untrusted networks. The source bundle’s structured affected-product fields are incomplete, so validation should rely on local asset inventory and vendor records. Prioritize if Wing FTP Server is still used in production or if its admin interface is internet-accessible. This is an old XSS flaw with incomplete public severity data, so urgency depends on exposure. Legacy file-transfer administration surfaces should be reviewed because compromise could affect sensitive operational workflows. Mitigation focus: Identify any Wing FTP Server for Windows deployments at version 3.5.0 or earlier.; Check Wing FTP vendor guidance for fixed versions or supported upgrade paths.; Restrict administrator web interface access to trusted management networks..

Prepared

Jun 28, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.