Veille CVE

Recherche « crushftp »

2 CVE

Critique 2 Élevée 0 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « crushftp » ✕
  1. CVE-2025-54309 9.8 Critique Exploitée

    CrushFTP · Crushftp crushftp

    CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

  2. CVE-2024-4040 10.0 Critique Exploitée

    crushftp · Crushftp crushftp

    A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.