Crafty Controller
CVEs (8)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-14700 | Cri | 0.65 | 9.9 | 0.06 | Dec 17, 2025 | An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection. | ||
| CVE-2026-0963 | Cri | 0.64 | 9.9 | 0.01 | Jan 30, 2026 | An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal. | ||
| CVE-2026-13716 | Cri | 0.59 | 9.1 | 0.01 | Aug 11, 2026 | Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution. | ||
| CVE-2026-5652 | Cri | 0.59 | 9.0 | 0.00 | Apr 21, 2026 | An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation. | ||
| CVE-2026-0805 | Hig | 0.53 | 8.2 | 0.01 | Jan 30, 2026 | An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal. | ||
| CVE-2025-5990 | Hig | 0.49 | 7.6 | 0.00 | Jun 15, 2025 | An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input. | ||
| CVE-2024-1064 | Hig | 0.49 | 7.5 | 0.01 | Feb 3, 2024 | A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host header | ||
| CVE-2025-14701 | Hig | 0.46 | 7.1 | 0.00 | Dec 17, 2025 | An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification. |
- risk 0.65cvss 9.9epss 0.06
An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.
- risk 0.64cvss 9.9epss 0.01
An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.
- risk 0.59cvss 9.1epss 0.01
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
- risk 0.59cvss 9.0epss 0.00
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
- risk 0.53cvss 8.2epss 0.01
An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.
- risk 0.49cvss 7.6epss 0.00
An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input.
- risk 0.49cvss 7.5epss 0.01
A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host header
- risk 0.46cvss 7.1epss 0.00
An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.