PT-2025-12973

Name of the Vulnerable Software and Affected Versions CrushFTP versions 10.0.0 through 10.8.3 CrushFTP versions 11.0.0 through 11.3.0 Description The vulnerability in CrushFTP is related to improper authentication, allowing remote and unauthenticated HTTP requests to gain unauthorized access. Thi...

PT-2025-14099

Name of the Vulnerable Software and Affected Versions CrushFTP versions 10.0.0 through 10.8.3 and versions 11.0.0 through 11.3.0 Description CrushFTP is affected by an authentication bypass issue that allows attackers to take over the crushadmin account, unless a DMZ proxy instance is used. This...

CVE-2024-22910

Cross Site Scripting XSS vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code via a crafted payload...

The vulnerability of the cross-platform FTP server CrushFTP, related to the lack of a password recovery mechanism, allows attackers to gain access to the user account and gain full control over the application.

The vulnerability of the cross-platform FTP server CrushFTP is related to the lack of a password recovery mechanism. Exploiting this vulnerability allows an attacker to remotely gain access to a user account and full control over the application by resetting the user’s password via email...

CVE-2024-11986

CVE-2024-11986 involves improper input handling of the Host Header in CrushFTP, allowing an unauthenticated attacker to craft input that is stored in web application logs and can execute when an Administrator views the logs. Connected sources identify CrushFTP as the affected product and note the...

CVE-2024-11986 Stored XSS in CrushFTP

Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scriptin...

CrushFTP 安全漏洞

CrushFTP is a file transfer server from CrushFTP, Inc. A security vulnerability exists in CrushFTP versions 10.8.2 and 11.2.1 that stems from the presence of incorrect input handling, which could allow an unauthenticated attacker to store payloads in web application logs, resulting in a stored...

CVE-2024-53552

CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover...

CVE-2024-53552

CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover...

CVE-2024-53552

CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover...

CrushFTP 安全漏洞

CrushFTP is a file transfer server from CrushFTP, Inc. A security vulnerability exists in CrushFTP that stems from mishandling the password reset logic, which could lead to an account takeover...

CVE-2024-53552

CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover...

CVE-2024-53552

CVE-2024-53552 affects CrushFTP 10 (up to 10.8.2) and 11 (up to 11.2.2); a flaw in the password reset mechanism allows an attacker to reset a user’s password via email and take full control of the account/application. The issue is confirmed in multiple sources and carries a high-severity impact (...

PT-2024-9817 · Crushftp · Crushftp

Name of the Vulnerable Software and Affected Versions: CrushFTP versions 10 through 10.8.2 CrushFTP versions 11 through 11.2.2 Description: The issue is related to a flaw in the password reset mechanism of CrushFTP, allowing a remote attacker to gain access to a user's account and take full contr...

Exploit for Code Injection in Crushftp

EN GenCrushSSTIExploit is a PoC exploit tool targeting the...

Exploit for Code Injection in Crushftp

EN GenCrushSSTIExploit is a PoC exploit tool targeting the...

CrushFTP Unauthenticated Arbitrary File Read

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CrushFTP Unauthenticated Arbitrary File Read', 'Description' = %q This module leverages an unauthenticated server-side template injection...

Exploit for Code Injection in Crushftp

CVE-2024-4040 Introduction I recently noticed this vuln...

CBL Mariner 2.0 Security Update: cert-manager / cf-cli / docker-buildx / erlang / kubernetes / kubevirt (CVE-2023-48795)

The version of cert-manager / cf-cli / docker-buildx / erlang / kubernetes / kubevirt installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-48795 advisory. - The SSH transport protocol with certain...

EulerOS 2.0 SP12 : python-paramiko (EulerOS-SA-2024-1750)

According to the versions of the python-paramiko package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to...