https://pwn.watch/i/crushftp-cve-2025-31161 CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise. Added to CISA KEV on 2025-04-07. en Mon, 07 Apr 2025 00:00:00 GMT https://pwn.watch/i/crushftp-cve-2025-31161 https://pwn.watch/i/crushftp-cve-2025-31161#2025-04-07-4ebd03cb Mon, 07 Apr 2025 00:00:00 GMT critical <p>CrushFTP: Authentication Bypass Vulnerability: CISA added CVE-2025-31161 to the KEV catalog (due 2025-04-28).</p>