The popular file transfer company CrushFTP has discovered a previously unknown vulnerability being exploited by hackers.