Dashboard / CVE-2025-63419

CVE-2025-63419

MEDIUM 2 PoCs
MEDIUM Priority: 0.02 BB Relevance: 72/100
Published: 2025-11-12 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Auth Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Required
S: Changed
C: Low
I: Low
A: None

Description

Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature reflects the filename to an emailbody field with no sanitations leading to HTML Injection.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
crushftp crushftp < 11.3.7_60

References & Advisories (2)

https://github.com/MMAKINGDOM/CVE-2025-63419/
Exploit Third Party Advisory

Proof of Concept (2)

★ 2
https://github.com/MMAKINGDOM/CVE-2025-63419
nomi-sec
—
https://github.com/hossainshadat/CVE-2025-63419
nomi-sec

Bug Bounty Relevance

72 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ PoC available (2)

CVSS Score

6.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS — Exploitation Probability

0.25%
Raw Score 0.002510
Percentile 16.6%
Date 2026-11-09

EPSS Trend

2026-11-09
0.00251
2026-11-08
0.00251
2026-11-07
0.00251
2026-11-06
0.00251
2026-11-05
0.00251

Intelligence Sources

nvd ref →

External Links