Exploit / PoCcriticalExploited in the wild

U.S. CISA adds CrushFTP, Google Chromium, and SysAid flaws to its Known Exploited Vulnerabilities catalog

Security Affairsby @securityaffairsJul 24, 2025 · 06:48 UTC (Jul 24, 2025)2 min read4 · 3 reads

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2025-54309 CVE-2025-6558 CVE-2025-2776 CVE-2025-2775 CVE-2024-36394

Tags: cve-2025-54309 cve-2025-6558 cve-2025-2776 cve-2025-2775 cve-2024-36394 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2024-36394	SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	9.8	1%		Jun 6, 2024
CVE-2025-2776 +1 related CVE CVE-2025-2775	Unauthenticated XXE in SysAid On-Prem Enables Admin Account Takeover	9.8 group max	65%	KEVPoC	May 7, 2025 KEV Jul 22, 2025
CVE-2025-54309	Unauthenticated Admin Access Bypass in CrushFTP (CVE-2025-54309)	9.8	93%	KEVPoC	Jul 18, 2025 KEV Jul 22, 2025
CVE-2025-6558	Actively Exploited Input Validation Flaw in Chrome ANGLE/GPU Allows Sandbox Escape	8.8	11%	KEV	Jul 15, 2025 KEV Jul 22, 2025

From the original article

2 min read at securityaffairs.com

U. S. CISA adds CrushFTP, Google Chromium, and SysAid flaws to its Known Exploited Vulnerabilities catalog.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.