Cross-site scripting in CrushFTP - CVE-2021-44076
Published: November 21, 2024 / Updated: June 23, 2025
Vulnerability identifier: #VU111844
CSH Severity: Medium
CVSS v4: []
CVE-ID: CVE-2021-44076
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. The vulnerability allows an attacker, with access to the administration panel, to perform Stored Cross-Site Scripting (XSS).
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Affected software
CrushFTP
How to mitigate CVE-2021-44076
Install update from vendor's website.