CVE-2025-63419
Cross-site scripting in Crushftp
CVSS score
6.1
EPSS probability
%0.3
Risk score
0.0
Published
11 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
GitHub
CrushFTP before 11.3.7_60 is vulnerable to HTML Injection. The Web-Based Server has a feature where users can share files, the feature reflects the filename to an emailbody field with no sanitzations leading to HTML Injection. (★0)
Makefile Go / Python
https://gist.github.com/MMAKINGDOM/39ded58b1e6d2d19366e76e0d5b1c851
Makefile Go / Python
Similar Vulnerabilities
5.9
CVE-2023-48795Vulnerability in N/a
Patch verified Public Exploits:10EPSS %94
8.6
-
CVE-2025-54309 Actively exploited CrushFTP Unprotected Alternate Channel Vulnerability
Workaround Public Exploits:9EPSS %93
-
CVE-2025-31161 Actively exploitedCrushFTP Authentication Bypass Vulnerability
Workaround Public Exploits:27EPSS %100
-
CVE-2024-4040 Actively exploitedCrushFTP VFS Sandbox Escape Vulnerability
Workaround Public Exploits:23EPSS %100
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-63419"