Crushftp vulnerabilities

Products

• Crushftp 19

Newest

• crushftp CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/ CVE-2015-20129 8.6 HighOctober 28, 2026
• crushftp Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a... CVE-2025-63419 Public exploit 6.1 MediumNovember 12, 2025
• crushftp A stored cross-site scripting (XSS) vulnerability in the CrushFTP 11.3.7_50 Admin Panel (Reports ... CVE-2025-63420 Public exploit 4.1 MediumNovember 7, 2025
• crushftp CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used,... CVE-2025-54309 In KEVPublic exploit EPSS 93.5% 9.0 CriticalJuly 18, 2025
• crushftp CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the ... CVE-2025-32103 EPSS 18.1% 5.0 MediumApril 15, 2025
• crushftp CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port... CVE-2025-32102 5.0 MediumApril 15, 2025
• crushftp CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the... CVE-2025-31161 In KEVPublic exploit EPSS 100.0% 9.8 CriticalApril 3, 2025
• crushftp Stored XSS in CrushFTP CVE-2024-11986 9.6 CriticalDecember 13, 2024
• crushftp CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account... CVE-2024-53552 9.8 CriticalDecember 10, 2024
• crushftp Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to... CVE-2024-22910 6.1 MediumMay 9, 2024
• crushftp Unauthenticated arbitrary file read and remote code execution in CrushFTP CVE-2024-4040 In KEVPublic exploit EPSS 99.5% 9.8 CriticalApril 22, 2024
• 9bis kitty, apache sshd, sshj +68 more +70 more Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin CVE-2023-48795 Public exploitFix available EPSS 93.5% 5.9 MediumDecember 18, 2023
• crushftp CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically... CVE-2023-43177 Public exploit EPSS 81.8% 9.8 CriticalNovember 17, 2023
• crushftp An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface... CVE-2021-44076 4.8 MediumSeptember 15, 2022
• crushftp CrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection. CVE-2018-18288 6.1 MediumDecember 26, 2019
• crushftp CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability. CVE-2017-14038 6.1 MediumAugust 30, 2017
• crushftp CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability. CVE-2017-14037 6.1 MediumAugust 30, 2017
• crushftp CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS. CVE-2017-14036 6.1 MediumAugust 30, 2017
• crushftp CrushFTP 8.x before 8.2.0 has a serialization vulnerability. CVE-2017-14035 9.8 CriticalAugust 30, 2017