medium4.1
CVE-2025-63420
CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execu…
Impact
CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin sessions.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Crushftp | Crushftp | from 11.0.1 before 11.3.7_57 |