Crushftp
10 CVEs across 1 Crushftp products. Browse Crushftp vulnerabilities, severities, and proof-of-concept exploits.
Crushftp products with known CVEs
Crushftp CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-63419 | Medium | 6.1 | 2025-11-12 | Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature reflects the filena… |
CVE-2025-63420 | Medium | 4.1 | 2025-11-07 | CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execu… |
CVE-2025-54309 | Critical | 9.0 | 2025-07-18 | CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers t… |
CVE-2025-32103 | Medium | 5.0 | 2025-04-15 | CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at… |
CVE-2025-32102 | Medium | 5.0 | 2025-04-15 | CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterfac… |
CVE-2025-31161 | Critical | 9.8 | 2025-04-03 | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as ex… |
CVE-2024-53552 | Critical | 9.8 | 2024-12-10 | CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover. |
CVE-2024-22910 | Medium | 6.1 | 2024-05-14 | Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code via a crafted payload. |
CVE-2024-4040 | Critical | 9.8 | 2024-04-22 | A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to… |
CVE-2023-48795 | Medium | 5.9 | 2023-12-18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks… |
CVE-2023-43177 | Critical | 9.8 | 2023-11-18 | CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes. |
CVE-2021-44076 | Medium | 4.8 | 2022-09-15 | An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the admin… |
CVE-2018-18288 | Medium | 6.1 | 2019-12-26 | CrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection. |
CVE-2017-14038 | Medium | 6.1 | 2017-08-30 | CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability. |
CVE-2017-14037 | Medium | 6.1 | 2017-08-30 | CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability. |
CVE-2017-14036 | Medium | 6.1 | 2017-08-30 | CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS. |
CVE-2017-14035 | Critical | 9.8 | 2017-08-30 | CrushFTP 8.x before 8.2.0 has a serialization vulnerability. |