CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2025-04-03
CrushFTP Authentication Bypass and Admin Account Takeover Vulnerability (CVE-2025-31161) Urgent Security Advisory
[Affected Scope] CrushFTP 10 before 10.8.4 and CrushFTP 11 before 11.3.1
[Impact] Unauthenticated attackers can bypass authentication via HTTP(S) ports to take over the 'crushadmin' account and fully compromise the system
[Mitigation] Immediately upgrade CrushFTP to version 10.8.4 / 11.3.1 or later, and enforce DMZ proxy configurations