CVE-2023-33263

CVE-2023-33263 describes a critical information disclosure vulnerability in WFTPD 3.25, where user credentials (usernames and password hashes) are stored in an unencrypted and publicly accessible wftpd.ini configuration file. This vulnerability carries a CVSS score of 7.5 (High), indicating that it can be exploited remotely with low attack complexity, leading to a complete compromise of confidentiality. While there is no evidence of active exploitation, public exploit code, or significant community discussion, the inherent risk of exposed credentials remains high for any legacy systems still utilizing this outdated software.