CVE-2020-22428: SolarWinds Serv-U FTP Server

Medium severity, CVSS 4.8. EPSS: 1.2% chance of exploitation in the next 30 days.

SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting (XSS) via a directory name (entered by an admin) containing a JavaScript payload.

Affected products

• SolarWinds Serv-U FTP Server: version 15.1 only
• SolarWinds Serv-U MFT Server: version 15.1 only

Published 2021-05-05. Last modified 2026-06-17.