CyberSec.Space Logo
Back to CVE Browser

CVE-2025-32102

MEDIUM
5.0
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2025-04-15
Last Modified2026-06-17
Data SourcesNVD

Vulnerability Description

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI.

Affected Platforms (CPE)

📦
Crushftp

Crushftp

>= 9.0.0 and <= 11.3.1

References & Advisories

🔗 https://packetstorm.news/files/id/190460/
🔗 https://seclists.org/fulldisclosure/2025/Apr/17
🔗 https://www.crushftp.com/
🔗 http://seclists.org/fulldisclosure/2025/Apr/17
🔗 https://seclists.org/fulldisclosure/2025/Apr/17

Related Vulnerabilities

CVE-2025-634196.1

Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, th...

CVE-2025-634204.1

CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), e...

CVE-2025-543099.0

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequen...

CVE-2025-321035.0

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to rea...