CrushFTP 10 / 11 Authentication Bypass

🗓️ 09 Apr 2025 00:00:00Reported by Kev Breen, Ben McCarthyType

There is a known authentication bypass in CrushFTP versions prior to 10.8.4 and 11.3.1, enabling creation of a privileged user.

Reporter	Title	Published	Views	Family All 64
GithubExploit	Exploit for CVE-2025-2825	22 Jul 202510:40	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	21 Oct 202517:49	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	20 Feb 202613:40	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	6 Jun 202509:14	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	8 Apr 202515:37	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	10 Sep 202500:20	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	21 Apr 202523:57	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	23 May 202521:04	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Primary Weakness in Crushftp	29 Oct 202523:17	–	githubexploit
GithubExploit	Exploit for Improper Restriction of XML External Entity Reference in Ivanti Endpoint_Manager	9 May 202403:10	–	githubexploit

09 Apr 2025 00:00Current

7High risk

Vulners AI Score7

CVSS 3.19.8

EPSS0.99947

SSVC