What’s Vulnerable › Vulnerabilities
CVE-2024-11986: Stored XSS in CrushFTP
- Severity: critical (CVSS 9.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-12-13 · updated 2026-06-17
- Weakness: CWE-79
Description
Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scripting'.
Affected products
- CrushFTP, LLC CrushFTP: from 10.0.0 before 10.8.2; from 11.0.0 before 11.2.1 — fixed in 10.8.2, 11.2.1
How to fix
Upgrade to a fixed version: CrushFTP, LLC CrushFTP 10.8.2, 11.2.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-11986 or the next vulnerability affects your stack