Threat Investigation
Request a demo

CVE-2025-63420

Medium

Description

CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin sessions.

SeverityMedium
CVSS4.1
Exploit probability—
ProductCrushftp
PublishedNov 7, 2025
First seenNov 7, 2025
Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update
  • crushftp crushftp11.3.7_57 or later

Affected products

ProductAffected versionsFixed in
crushftp crushftp11.0.1 ≤ v < 11.3.7_5711.3.7_57

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.