CrushFTP vulnerabilities
6 published CVEs name CrushFTP among the affected products; CISA lists 3 of them as exploited in the wild.
- Published CVEs
- 6
- Last 12 months
- 1
- Critical
- 3
- Known exploited
- 3
Critical 3High 1Medium 2Low 0Not scored 0
CVEs per yearBy the year they were published
- 20241
- 20254
- 20261
Known exploitedNewest addition to KEV first
- CVE-2025-54309
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers…
CrushFTP · CrushFTP
ExploitedCritical9.0 - CVE-2025-31161
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as…
CrushFTP · CrushFTP
ExploitedCritical9.8 - CVE-2024-4040
Unauthenticated arbitrary file read and remote code execution in CrushFTP
CrushFTP · CrushFTP
ExploitedCritical9.8
Newest CVEs
- CVE-2015-20129
CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/
CrushFTP · CrushFTP
High8.6 - CVE-2025-54309
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers…
CrushFTP · CrushFTP
ExploitedCritical9.0 - CVE-2025-32103
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at…
CrushFTP · CrushFTP
Medium5.0 - CVE-2025-32102
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the…
CrushFTP · CrushFTP
Medium5.0 - CVE-2025-31161
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as…
CrushFTP · CrushFTP
ExploitedCritical9.8 - CVE-2024-4040
Unauthenticated arbitrary file read and remote code execution in CrushFTP
CrushFTP · CrushFTP
ExploitedCritical9.8