Login Request a demo
CR
Product
CrushFTP
by CrushFTP · last CVE Oct 28, 2026
On CISA KEVExploited in the wildRansomware-linked
18
CVEs
3
On KEV
10.0
Max CVSS
1
New 30D
Vulnerabilities18In the news1Timeline
Severity mix
Critical 6High 1Medium 11Low 0
Severity
All severities18Critical6High1Medium11Low0
Exploitation
On CISA KEV3Exploited in the wild3
Watch

Add CrushFTP to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-63419
6.1
0%
Nov 12
Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48
Affected: before 11.3.7_60
CVE-2024-22910
6.1
1%
May 14
Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code via a crafted payload
Affected: before 10.6.1
CVE-2018-18288
6.1
1%
Dec 26
CrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection
Affected: through 8.3.0
CVE-2017-14038
6.1
1%
Aug 30
CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability
Affected: through 7.7.0; 8.0.2; 8.0.3; 8.0.4; 8.1.0
CVE-2017-14037
6.1
1%
Aug 30
CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability
Affected: through 7.7.0; 8.0.2; 8.0.3; 8.0.4; 8.1.0
CVE-2017-14036
6.1
1%
Aug 30
CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS
Affected: through 7.7.0; 8.0.2; 8.0.3; 8.0.4; 8.1.0
CVE-2023-48795
5.9
94%
Dec 18
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some…
Affected: through 10.6.0; before 10.6.0
CVE-2025-32103
5.0
18%
Apr 15
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames,…
Affected: 9.0.0 through 11.3.1
CVE-2025-32102
5.0
9%
Apr 15
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI
Affected: 9.0.0 through 11.3.1
CVE-2021-44076
4.8
1%
Sep 15
An issue was discovered in CrushFTP 9
Affected: 9.0.0 before 9.4.0_15
CVE-2025-63420
4.1
0%
Nov 7
CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin…
Affected: 11.0.1 before 11.3.7_57
Showing 11