CVE-2025-63419

Medium · 6.1

CVSS

6.1

EPSS

0.3%

Published

Nov 12, 2025

CISA due date

—

The record

Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature reflects the filename to an emailbody field with no sanitations leading to HTML Injection.

Affected packages

Ecosystem	Package	Introduced	Fixed