Crafty 4
Source repositories
CVEs (6)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-14700 | Cri | 0.65 | 9.9 | 0.07 | Dec 17, 2025 | An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection. | ||
| CVE-2026-0963 | Cri | 0.64 | 9.9 | 0.01 | Jan 30, 2026 | An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal. | ||
| CVE-2026-5652 | Cri | 0.59 | 9.0 | 0.00 | Apr 21, 2026 | An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation. | ||
| CVE-2026-0805 | Hig | 0.53 | 8.2 | 0.01 | Jan 30, 2026 | An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal. | ||
| CVE-2025-5990 | Hig | 0.49 | 7.6 | 0.00 | Jun 15, 2025 | An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input. | ||
| CVE-2025-14701 | Hig | 0.46 | 7.1 | 0.00 | Dec 17, 2025 | An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification. |
- risk 0.65cvss 9.9epss 0.07
An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.
- risk 0.64cvss 9.9epss 0.01
An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.
- risk 0.59cvss 9.0epss 0.00
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
- risk 0.53cvss 8.2epss 0.01
An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.
- risk 0.49cvss 7.6epss 0.00
An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input.
- risk 0.46cvss 7.1epss 0.00
An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.