Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

CVE-2026-90821

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Arcadia Technology
Products
Crafty Controller
CVE-2026-18516

Improper Encoding or Escaping of Output in Crafty Controller

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Arcadia Technology
Products
Crafty Controller
CVE-2026-5652

Authorization Bypass Through User-Controlled Key in Crafty Controller

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Arcadia Technology Craftycontrol
Products
Crafty Controller Crafty Controller
CVE-2026-13716

Path Traversal: '.../...//' in Crafty Controller

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Arcadia Technology Craftycontrol
Products
Crafty Controller Crafty Controller
CVE-2026-0963

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller

An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Arcadia Technology Craftycontrol
Products
Crafty Controller Crafty Controller
CVE-2026-0805

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller

An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Arcadia Technology Craftycontrol
Products
Crafty Controller Crafty Controller
CVE-2025-14701

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Arcadia Technology Craftycontrol
Products
Crafty Controller Crafty Controller
CVE-2025-14700

Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller

An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.

CVSS 3.1 · 9.9 Critical EPSS 6.6% KEV · Not listed
Vendors
Arcadia Technology Craftycontrol
Products
Crafty Controller Crafty Controller