Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19 results
Oct 27, 2026CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disCVE-2015-20129 · Other software · CrushFTP · reported by VulnCheckHigh 8.6
CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.
- Product
- CrushFTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcrushftp.comexploit-db.com
Nov 12, 2025Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48.CVE-2025-63419 · Other software · Crushftp · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature reflects the filename to an emailbody field with no sanitations leading to HTML Injection.
- Product
- Crushftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 7, 2025CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML executCVE-2025-63420 · Other software · Crushftp · reported by MITREMedium 4.1
CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin sessions.
- Product
- Crushftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 18, 2025 CrushFTP Unprotected Alternate Channel VulnerabilityCVE-2025-54309 · Other software · CrushFTP · reported by MITREExploitedCritical 9
CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.
- Product
- CrushFTP
- On CISA’s list since
- Jul 22, 2025 (federal fix deadline Aug 12, 2025)
- What to do
- Attackers are using this now. Install CrushFTP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogbleepingcomputer.comcrushftp.com
Apr 15, 2025CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UCVE-2025-32103 · Other software · CrushFTP · reported by MITREMedium 5
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions.
- Product
- CrushFTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newsseclists.org
Apr 15, 2025CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterfaceCVE-2025-32102 · Other software · CrushFTP · reported by MITREMedium 5
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI.
- Product
- CrushFTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newsseclists.org
Apr 3, 2025CrushFTP Authentication Bypass VulnerabilityCVE-2025-31161 · Other software · CrushFTP · reported by MITREExploitedRansomwareCritical 9.8
CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.
- Product
- CrushFTP
- On CISA’s list since
- Apr 7, 2025 (federal fix deadline Apr 28, 2025)
- What to do
- Attackers are using this now. Install CrushFTP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcrushftp.comoutpost24.com
Dec 13, 2024Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs.CVE-2024-11986 · Other software · CrushFTP, LLC · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 9.6
Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scripting'.
- Product
- CrushFTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover.CVE-2024-53552 · Other software · Crushftp · reported by MITRECritical 9.8
CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover.
- Product
- Crushftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code via a crafted payload.CVE-2024-22910 · Other software · Crushftp · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code via a crafted payload.
- Product
- Crushftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 22, 2024CrushFTP VFS Sandbox Escape VulnerabilityCVE-2024-4040 · Other software · CrushFTP · reported by 430a6cef-dc26-47e3-9fa8-52fb7f19644eExploitedCritical 9.8
CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).
- Product
- CrushFTP
- On CISA’s list since
- Apr 24, 2024 (federal fix deadline May 1, 2024)
- What to do
- Attackers are using this now. Install CrushFTP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.combleepingcomputer.com
Nov 17, 2023CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.CVE-2023-43177 · Other software · Crushftp · reported by MITRECritical 9.8
CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.
- Product
- Crushftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconvergetp.comgithub.com
Sep 15, 2022An issue was discovered in CrushFTP 9.CVE-2021-44076 · Other software · Crushftp · reported by MITREMedium 4.8
An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-Site Scripting (XSS). The payload can be executed in multiple scenarios, for example when the user's page appears in the Most Visited section of the page.
- Product
- Crushftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.nettitude.comcrushftp.com
Dec 25, 2019CrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection.CVE-2018-18288 · Other software · Crushftp · reported by MITREMedium 6.1
CrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection.
- Product
- Crushftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcrushftp.comcrushftp.com
Aug 30, 2017CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability.CVE-2017-14038 · Other software · Crushftp · reported by MITREMedium 6.1
CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability.
- Product
- Crushftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcrushftp.comcrushftp.com
Aug 30, 2017CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability.CVE-2017-14037 · Other software · Crushftp · reported by MITREMedium 6.1
CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability.
- Product
- Crushftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcrushftp.comcrushftp.com
Aug 30, 2017CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS.CVE-2017-14036 · Other software · Crushftp · reported by MITREMedium 6.1
CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS.
- Product
- Crushftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcrushftp.comcrushftp.com
Aug 30, 2017CrushFTP 8.x before 8.2.0 has a serialization vulnerability.CVE-2017-14035 · Other software · Crushftp · reported by MITRECritical 9.8
CrushFTP 8.x before 8.2.0 has a serialization vulnerability.
- Product
- Crushftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcrushftp.comcrushftp.com
Aug 22, 2001Ben Spink CrushFTP FTP Server 2.1.6 and earlier allows a local attacker to access arbitrary files via a '..' (dot dot) attack, or variations, in (1) GET, (2) CDCVE-2001-0582 · Other software · BEN Spink · reported by MITREMedium 4.6
Ben Spink CrushFTP FTP Server 2.1.6 and earlier allows a local attacker to access arbitrary files via a '..' (dot dot) attack, or variations, in (1) GET, (2) CD, (3) NLST, (4) SIZE, (5) RETR.
- Product
- Crushftp FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comkb.cert.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.