CrushFTP vulnerabilities
6 published CVEs name CrushFTP among the affected products; CISA lists 3 of them as exploited in the wild.
- 6Published CVEs6 of them scored
- 1Last 12 monthspublished in the last year
- 3Critical1 more rated high
- 3Known exploitedin CISA's KEV catalog
Known exploited
Newest addition to KEV first.
- CVE-2025-54309
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers…
CrushFTP · CrushFTP
ExploitedCritical9.0 - CVE-2025-31161
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as…
CrushFTP · CrushFTP
ExploitedCritical9.8 - CVE-2024-4040
Unauthenticated arbitrary file read and remote code execution in CrushFTP
CrushFTP · CrushFTP
ExploitedCritical9.8