CVE-2025-32102

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI.

• CWE-918

• https://packetstorm.news/files/id/190460/Exploit, Third Party Advisory, VDB Entry
• https://seclists.org/fulldisclosure/2025/Apr/17Mailing List, Third Party Advisory
• https://www.crushftp.com/Product
• http://seclists.org/fulldisclosure/2025/Apr/17
• https://seclists.org/fulldisclosure/2025/Apr/17Mailing List, Third Party Advisory

Published

Apr 15, 2025

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32094An issue was discovered in Akamai Ghost, as used for the Aka…4
• CVE-2025-32095Pexip Infinity before 37.0 has improper input validation in …7.5
• CVE-2025-32096Pexip Infinity 33.0 through 37.0 before 37.1 has improper in…7.5
• CVE-2025-32098An issue was discovered in Samsung Magician 6.3 through 8.3 …5.3
• CVE-2025-3210A vulnerability was found in code-projects Patient Record Ma…7.5
• CVE-2025-32100An issue was discovered in Samsung Mobile Processor, Wearabl…6.5
• CVE-2025-32103CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1…5
• CVE-2025-32105A buffer overflow in the the Sangoma IMG2020 HTTP server thr…9.8
• CVE-2025-32106In Audiocodes Mediapack MP-11x through 6.60A.369.002, a craf…9.8
• CVE-2025-32107OS command injection vulnerability exists in Deco BE65 Pro f…8
• CVE-2025-3211A vulnerability classified as critical has been found in cod…7.5
• CVE-2025-32111The Docker image from acme.sh before 40b6db6 is based on a .…8.7