Log in Start free

CrushFTP

Products

ProductCVEsExploitedLatest
CrushFTP53Jul 18, 2025

Exploited and recent CVEs

  • CVE-2025-54309 Critical 9.0 Exploited CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as explo 93.5%
  • CVE-2025-31161 Critical 9.8 Exploited CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 20 100.0%
  • CVE-2024-4040 Critical 9.8 Exploited Unauthenticated arbitrary file read and remote code execution in CrushFTP 99.5%
  • CVE-2025-32102 Medium 5.0 CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI. 9.4%
  • CVE-2025-32103 Medium 5.0 CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityMa 18.1%