CVE-2015-20129 CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like...

CVE-2015-20129

CrushFTP versions before 7.3.0 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw due to disabled CSRF protection by default. An attacker can lure an authenticated administrator to a malicious page that automatically submits POST requests to the /WebInterface/function/ endpoint. This allo...

CVE-2015-20129 CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like...

CrushFTP CVE-2025-31161 auth bypass user creation

CVE-2025-31161: crafted CrushAuth / AWS4 Authorization headers allow unauthenticated setUserItem on /WebInterface/function/, creating a new FTP/WebInterface user. Default is detect-only; set confirm=true to create the configured account destructive. !/usr/bin/env python3 -- coding: utf-8 --...

EUVD-2025-10978

Malicious code in bioql PyPI...

CVE-2025-32102

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI...

CVE-2025-32103: Path Traversal: '\\UNC\share\name\' (Windows UNC Share)

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions...

CVE-2025-32102: Server-Side Request Forgery (SSRF)

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI...