CVE-2015-20129

HIGH 8.8

CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.

CWE	CWE-352
Vendor	crushftp
Product	crushftp
Published	Oct 28, 2026

Stay Ahead of the Next One

Get instant alerts for crushftp crushftp

Be the first to know when new high vulnerabilities affecting crushftp crushftp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

CrushFTP / CrushFTP

0 < 7.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

exploit-db.com: https://www.exploit-db.com/exploits/36126 crushftp.com: https://www.crushftp.com/version7.html vulncheck.com: https://www.vulncheck.com/advisories/crushftp-before-7.3.0-cross-site-request-forgery-via-webinterface-function

Credits

Rehan Ahmed