CR
Product
CrushFTP
On CISA KEVExploited in the wildRansomware-linked
18
CVEs
3
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 6High 1Medium 11Low 0
Watch
Add CrushFTP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-4040 In wildKEV | 10.0 | Apr 22 | Unauthenticated arbitrary file read and remote code execution in CrushFTP Affected: 10.0 before 10.7.1; 11.0 before 11.1.0 |
| CVE-2025-54309 In wildKEV | 9.8 | Jul 18 | CrushFTP Unprotected Alternate Channel Vulnerability Affected: 10 before 10.8.5; 11 before 11.3.4_23 |
| CVE-2025-31161 RansomwareIn wildKEV | 9.8 | Apr 3 | CrushFTP Authentication Bypass Vulnerability Affected: 10 before 10.8.4; 11 before 11.3.1 |
| CVE-2024-53552 | 9.8 | Dec 10 | CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover Affected: 10.0.0 before 10.8.3; 11.0.0 before 11.2.3 |
| CVE-2023-43177 | 9.8 | Nov 18 | CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes Affected: before 10.5.2 |
| CVE-2017-14035 | 9.8 | Aug 30 | CrushFTP 8.x before 8.2.0 has a serialization vulnerability Affected: 8.0.2; 8.0.3; 8.0.4; 8.1.0 |
| CVE-2015-20129 New | 8.8 | Oct 28 | CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/ Affected: before 7.3.0 |
| CVE-2025-63419 | 6.1 | Nov 12 | Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48 Affected: before 11.3.7_60 |
| CVE-2024-22910 | 6.1 | May 14 | Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code via a crafted payload Affected: before 10.6.1 |
| CVE-2018-18288 | 6.1 | Dec 26 | CrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection Affected: through 8.3.0 |
| CVE-2017-14038 | 6.1 | Aug 30 | CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability Affected: through 7.7.0; 8.0.2; 8.0.3; 8.0.4; 8.1.0 |
| CVE-2017-14037 | 6.1 | Aug 30 | CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability Affected: through 7.7.0; 8.0.2; 8.0.3; 8.0.4; 8.1.0 |
| CVE-2017-14036 | 6.1 | Aug 30 | CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS Affected: through 7.7.0; 8.0.2; 8.0.3; 8.0.4; 8.1.0 |
| CVE-2023-48795 | 5.9 | Dec 18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some… Affected: through 10.6.0; before 10.6.0 |
| CVE-2025-32103 | 5.0 | Apr 15 | CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames,… Affected: 9.0.0 through 11.3.1 |
| CVE-2025-32102 | 5.0 | Apr 15 | CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI Affected: 9.0.0 through 11.3.1 |
| CVE-2021-44076 | 4.8 | Sep 15 | An issue was discovered in CrushFTP 9 Affected: 9.0.0 before 9.4.0_15 |
| CVE-2025-63420 | 4.1 | Nov 7 | CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin… Affected: 11.0.1 before 11.3.7_57 |
Showing 18