Craftycontrol Crafty Controller — known CVE vulnerabilities

Every CVE whose affected-product data names Craftycontrol Crafty Controller, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (7)

• CVE-2025-14700 — CVSS 9.9 (critical): An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to…
• CVE-2026-0963 — CVSS 9.9 (critical): An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated…
• CVE-2026-5652 — CVSS 9.0 (critical): An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker…
• CVE-2026-0805 — CVSS 8.2 (high): An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to…
• CVE-2025-5990 — CVSS 7.6 (high): An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote…
• CVE-2024-1064 — CVSS 7.5 (high): A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to…
• CVE-2025-14701 — CVSS 7.1 (high): An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to…