CVE-2025-5990: An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to…

PriorityP427medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.21%

11.5th percentile

An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
arcadia_technology_llc	crafty_controller	4.2.2 – 4.2.3	—
arcadia_technology_llc	crafty_controller	4.3.0 – 4.3.2	—
arcadia_technology_llc	crafty_controller	>= 4.4.0 < 4.4.10	4.4.10
craftycontrol	crafty_controller	—	—
craftycontrol	crafty_controller	>= 4.3.0 < 4.3.2	4.3.2
craftycontrol	crafty_controller	>= 4.4.0 < 4.4.10	4.4.10
gitlab	crafty_controller	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.