CR
Product
CrushFTP
On CISA KEVExploited in the wildRansomware-linked
18
CVEs
3
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 6High 1Medium 11Low 0
Watch
Add CrushFTP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-4040 In wildKEV | 10.0 | Apr 22 | Unauthenticated arbitrary file read and remote code execution in CrushFTP Affected: 10.0 before 10.7.1; 11.0 before 11.1.0 |
| CVE-2025-54309 In wildKEV | 9.8 | Jul 18 | CrushFTP Unprotected Alternate Channel Vulnerability Affected: 10 before 10.8.5; 11 before 11.3.4_23 |
| CVE-2025-31161 RansomwareIn wildKEV | 9.8 | Apr 3 | CrushFTP Authentication Bypass Vulnerability Affected: 10 before 10.8.4; 11 before 11.3.1 |
| CVE-2024-53552 | 9.8 | Dec 10 | CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover Affected: 10.0.0 before 10.8.3; 11.0.0 before 11.2.3 |
| CVE-2023-43177 | 9.8 | Nov 18 | CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes Affected: before 10.5.2 |
| CVE-2017-14035 | 9.8 | Aug 30 | CrushFTP 8.x before 8.2.0 has a serialization vulnerability Affected: 8.0.2; 8.0.3; 8.0.4; 8.1.0 |
Showing 6