MMAKINGDOM/CVE-2025-63419

MMAKINGDOM/CVE-2025-63419

GitHubGitHub
GitHubgithub.com
Releases0
CrushFTP before 11.3.7_60 is vulnerable to HTML Injection. The Web-Based Server has a feature where users can share files, the feature reflects the filename to an emailbody field with no sanitzations leading to HTML Injection.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2025-63419↗
6.1 MEDIUM—

Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature reflects the filename to an emailbody field with no sanitations leading to HTML Injection.