[ Vendor · 3 CVEs ]
CrushFTP
CVEs affecting CrushFTP published in the last 30 days, plus any CrushFTP CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2025-54309 | 18 Jul 2025 | CVSS 9.8 | CrushFTP Unprotected Alternate ChannelCrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote… | Exploited |
| CVE-2025-31161 | 3 Apr 2025 | CVSS 9.8 | CrushFTP Authentication BypassCrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is… | Exploited |
| CVE-2024-4040 | 22 Apr 2024 | CVSS 10.0 | CrushFTP VFS Sandbox EscapeA server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote… | ExploitedFix |