Unrated severityOSV Advisory· Published Dec 17, 2025· Updated Dec 17, 2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
CVE-2025-14701
Description
An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: 4.0.0-alpha.3, v4.0.0-alpha-3-hotfix.1, v4.0.0-alpha-3-hotfix.2, …
Patches
Vulnerability mechanics
References
1- gitlab.com/crafty-controller/crafty-4/-/issues/647mitreissue-trackingpermissions-required
News mentions
0No linked articles in our index yet.