Approved changes feed: RSS · Atom
cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Crushftp (9705ed3b-6821-503e-98eb-1fa18fc9f171) |
|---|---|
| Product | Crushftp (e5db427e-10c2-5b99-9230-da3e557d4b8b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2015-20129 |
vulnerable | 2026-11-03 10:55:51.460196 |
CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/
HIGH (8.8)
CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.
Published: 2026-10-28T02:03:14.501Z
Updated: 2026-11-03T12:34:22.113Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-63420 |
vulnerable | 2026-06-08 07:39:17.583298 |
Details available
CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin sessions.
Published: 2025-11-07T00:00:00.000Z
Updated: 2025-11-10T21:45:10.932Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-63419 |
vulnerable | 2026-06-08 07:39:17.582771 |
Details available
Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature reflects the filename to an emailbody field with no sanitations leading to HTML Injection.
Published: 2025-11-12T00:00:00.000Z
Updated: 2025-11-12T21:35:39.033Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-54309 |
vulnerable | 2026-06-08 07:33:12.327925 |
Details available
CRITICAL (9)
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
Published: 2025-07-18T00:00:00.000Z
Updated: 2025-10-21T22:45:21.853Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32103 |
vulnerable | 2026-06-08 07:18:59.157487 |
Details available
MEDIUM (5)
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions.
Published: 2025-04-15T00:00:00.000Z
Updated: 2025-11-03T19:53:21.052Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32102 |
vulnerable | 2026-06-08 07:18:59.157097 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-31161 |
vulnerable | 2026-06-08 07:17:02.479649 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2825 |
vulnerable | 2026-06-08 07:16:58.438242 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-53552 |
vulnerable | 2026-06-08 06:54:15.075394 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-4040 |
vulnerable | 2026-06-08 06:50:16.907686 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-22910 |
vulnerable | 2026-06-08 06:29:36.156114 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-48795 |
vulnerable | 2026-06-08 06:14:28.127863 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-43177 |
vulnerable | 2026-06-08 06:11:10.995830 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-44076 |
vulnerable | 2026-06-08 05:36:44.861317 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-18288 |
vulnerable | 2026-06-08 05:11:07.404422 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-14038 |
vulnerable | 2026-06-08 05:08:49.149968 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-14037 |
vulnerable | 2026-06-08 05:08:49.149565 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-14036 |
vulnerable | 2026-06-08 05:08:49.148975 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.