Skip to content

Vendor

crushftp vulnerabilities

19 published CVES affecting crushftp, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
19
Critical
7
High
1
Medium
11
Low
0
Unscored
0
CISA KEV
3
Atom feed of crushftp alerts

Products

Latest crushftp CVEs

Newest publication first

  4. CVE-2025-54309 CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as explo...

    Published
    CriticalCVSS 9.8 EPSS 93.5% CISA KEV added 2025-07-22 Exploited in the wild

    CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

  7. CVE-2025-31161 CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 20...

    Published
    CriticalCVSS 9.8 EPSS 100.0% CISA KEV added 2025-04-07 Ransomware Exploited in the wild

    CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AW...

  8. CVE-2024-11986 Stored XSS in CrushFTP

    Published
    CriticalCVSS 9.6 EPSS 0.57%

    Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cr...

  11. CVE-2024-4040 Unauthenticated arbitrary file read and remote code execution in CrushFTP

    Published
    CriticalCVSS 10.0 EPSS 99.5% CISA KEV added 2024-04-24 Exploited in the wild Framework module PoC

    A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perf...

  14. CVE-2021-44076 An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-...

    Published
    MediumCVSS 4.8 EPSS 0.70%

    An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-Site Scripting (XSS). The payload can be executed in multiple scenarios, for exa...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.