CR
Vendor
CrushFTP
18
CVEs
3
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2015-20129 New | CR CrushFTP CrushFTP | 8.8 | Oct 28 | CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/ |
| CVE-2025-63419 | CR Crushftp Crushftp | 6.1 | Nov 12 | Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48 |
| CVE-2025-63420 | CR Crushftp Crushftp | 4.1 | Nov 7 | CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin… |
| CVE-2025-54309 In wildKEV | CR CrushFTP CrushFTP | 9.8 | Jul 18 | CrushFTP Unprotected Alternate Channel Vulnerability |
| CVE-2025-32103 | CR Crushftp Crushftp | 5.0 | Apr 15 | CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames,… |
| CVE-2025-32102 | CR Crushftp Crushftp | 5.0 | Apr 15 | CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI |
| CVE-2025-31161 RansomwareIn wildKEV | CR CrushFTP CrushFTP | 9.8 | Apr 3 | CrushFTP Authentication Bypass Vulnerability |
| CVE-2024-53552 | CR Crushftp Crushftp | 9.8 | Dec 10 | CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover |
| CVE-2024-22910 | CR Crushftp Crushftp | 6.1 | May 14 | Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code via a crafted payload |
| CVE-2024-4040 In wildKEV | CR CrushFTP CrushFTP | 10.0 | Apr 22 | Unauthenticated arbitrary file read and remote code execution in CrushFTP |
| CVE-2023-48795 | CR Crushftp Crushftp | 5.9 | Dec 18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some… |
| CVE-2023-43177 | CR Crushftp Crushftp | 9.8 | Nov 18 | CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes |
| CVE-2021-44076 | CR Crushftp Crushftp | 4.8 | Sep 15 | An issue was discovered in CrushFTP 9 |
| CVE-2018-18288 | CR Crushftp Crushftp | 6.1 | Dec 26 | CrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection |
| CVE-2017-14038 | CR Crushftp Crushftp | 6.1 | Aug 30 | CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability |
| CVE-2017-14037 | CR Crushftp Crushftp | 6.1 | Aug 30 | CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability |
| CVE-2017-14036 | CR Crushftp Crushftp | 6.1 | Aug 30 | CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS |
| CVE-2017-14035 | CR Crushftp Crushftp | 9.8 | Aug 30 | CrushFTP 8.x before 8.2.0 has a serialization vulnerability |