Forest Global Training Partners

Known Exploited Vulnerabilities · CISA KEV Catalog

CVE-2025-31161: CrushFTP Authentication Bypass Vulnerability

CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.

Read the original at CISA KEV Catalog ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2025-31161CrushFTP
Related
CVE-2025-54309: CrushFTP Unprotected Alternate Channel Vulnerability Known Exploited Vulnerabilities · Jul 22, 2025
CVE-2024-4040: CrushFTP VFS Sandbox Escape Vulnerability Known Exploited Vulnerabilities · Apr 24, 2024