Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*

2 briefs RSS
critical advisory

CrushFTP: Authentication bypass and administrative account creation (CVE-2025-54309)

CVE-2025-54309 is an authentication bypass vulnerability in CrushFTP allowing unauthenticated administrative account creation via manipulation of the AS2-To header.

CrushFTP +2 authentication-bypass web-exploitation
1r 4t 2c updated
high threat

CrushFTP Authentication Bypass Exploitation

CVE-2025-31161 in CrushFTP is being exploited to gain unauthorized access and execute malicious commands, with activity linked to Hellcat ransomware operations.

exploited PoC CrushFTP +1 web ransomware vulnerability
1r 3t 1c updated