Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

CVE-2026-5652

Authorization Bypass Through User-Controlled Key in Crafty Controller

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Arcadia Technology Craftycontrol
Products
Crafty Controller Crafty Controller
CVE-2026-13716

Path Traversal: '.../...//' in Crafty Controller

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Arcadia Technology Craftycontrol
Products
Crafty Controller Crafty Controller
CVE-2026-0963

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller

An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Arcadia Technology Craftycontrol
Products
Crafty Controller Crafty Controller
CVE-2026-0805

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller

An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Arcadia Technology Craftycontrol
Products
Crafty Controller Crafty Controller
CVE-2025-14701

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Arcadia Technology Craftycontrol
Products
Crafty Controller Crafty Controller
CVE-2025-14700

Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller

An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.

CVSS 3.1 · 9.9 Critical EPSS 6.6% KEV · Not listed
Vendors
Arcadia Technology Craftycontrol
Products
Crafty Controller Crafty Controller
CVE-2025-5990

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Craftycontrol
Products
Crafty Controller
CVE-2024-1064

Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4

A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host header

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Craftycontrol
Products
Crafty Controller