WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Winscp | Winscp | * | 5.17.10 (excluding) |