CVE-2023-40045

—

CVSS 3.1

6.1 medium

EPSS

<1%p57

Published

Sep 27, 2023 (Sep 27, 2023)

Modified

Jun 17, 2026

Description

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module. An attacker could leverage this vulnerability to target WS_FTP Server users with a specialized payload which results in the execution of malicious JavaScript within the context of the victims browser.

Vendors: progress
Products: ws ftp server
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news2 stories

Critical vulnerability in WS_FTP Server exploited by attackers (CVE-2023-40044)

Help Net SecurityJun 8, 10:34 UTC · Jun 8, 2026Vulnerability CVE-2023-40044 CVE-2023-42657 CVE-2023-40045

Progress Software Releases Urgent Hotfixes for Multiple Security Flaws in WS_FTP Server

The Hacker NewsOct 9, 06:43 UTC · Oct 9, 2023Ransomware in the wildCVE-2023-40044 CVE-2023-42657 CVE-2023-40045+5 CVEs