CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
CrushFTP AS2 Validation Authentication Bypass Vulnerability (CVE-2025-54309) Security Advisory
[Affected Scope] CrushFTP 10 before 10.8.5 and CrushFTP 11 before 11.3.4_23, specifically when the DMZ proxy feature is not utilized.
[Impact] Unauthenticated remote attackers can bypass AS2 validation via HTTPS to obtain full administrative access, which has been actively exploited in the wild.
[Mitigation] Immediately upgrade to CrushFTP 10.8.5, 11.3.4_23, or later, or restrict direct HTTPS access and enable the DMZ proxy feature.
Cisco IOS XE Web UI Remote Privilege Escalation and System Compromise (CVE-2023-20198)
[Affected Scope] Cisco IOS XE Software with the Web UI feature enabled and exposed to the internet
[Impact] Unauthenticated remote attackers can bypass authentication to create a local user with Privilege 15 access, subsequently elevating to root to install a persistent malicious implant
[Mitigation] Immediately disable the Web UI (HTTP/HTTPS Server) feature or restrict access to trusted management networks, and upgrade to the recommended fixed software releases