Advisories · Technology
CrushFTP.
Every CVE that names CrushFTP among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.6 High
CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/
- CrushFTP
- Cross-site request forgery (CSRF)
- CVSS 9.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
CrushFTP: CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23…
- CrushFTP
- CWE-420
- CVSS 5.0 Medium
CrushFTP: CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal…
- CrushFTP
- CWE-40
- CVSS 5.0 Medium
Server-side request forgery in CrushFTP
- CrushFTP
- Server-side request forgery (SSRF)
- CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware
CrushFTP: CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover…
- CrushFTP
- CWE-305
- CVSS 9.6 CriticalCritical · CVSS 9+
Stored XSS in CrushFTP
- CrushFTP
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Unauthenticated arbitrary file read and remote code execution in CrushFTP
- CrushFTP
- Code injection