Do Son A Critical flaw in Lite XL (CVE-2025-12120) allows RCE when opening a project: the editor automatically executes malicious .lite_project.lua files, risking developer compromise.
Lua
Redis patched a Critical (CVSS 10.0) RCE flaw (CVE-2025-49844) in Lua scripting. An authenticated attacker can exploit a Use-After-Free bug to gain code execution.
CISA adds critical Wing FTP Server RCE flaw (CVE-2025-47812, CVSS 10.0) to KEV. Actively exploited via null byte and Lua code injection; patch to 7.4.4 immediately!
Huntress witnessed active exploitation of a critical RCE flaw (CVE-2025-47812) in Wing FTP Server, allowing root/SYSTEM access via null byte injection and Lua code execution.