CVE-2025-63420

Description

A stored cross-site scripting (XSS) vulnerability in the CrushFTP 11.3.7_50 Admin Panel (Reports / 'Who Created Folder') allows authenticated attackers with permissions to create folders to inject malicious HTML/JavaScript.

References

https://github.com/MMAKINGDOM/CVE-2025-63420/

https://gist.github.com/MMAKINGDOM/791d264c27656f0a4aa3c0ae35075e70

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3