Unrated severityNVD Advisory· Published Jun 15, 2025· Updated Jun 16, 2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
CVE-2025-5990
Description
An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Arcadia Technology, LLC/Crafty Controllerv5Range: 4.2.2
Patches
Vulnerability mechanics
References
1- gitlab.com/crafty-controller/crafty-4/-/issues/567mitreissue-trackingpermissions-required
News mentions
0No linked articles in our index yet.