CVE-2025-5990 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

CVE-2025-5990

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller PUBLISHED

Description (CNA)

An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input.

Affected (CNA)

Vendor / product	Versions
Arcadia Technology, LLC / Crafty Controller	affected 4.2.2 through 4.2.3; affected 4.3.0 through 4.3.2; affected 4.4.0 before 4.4.10

CWE

CWE-79

References

https://gitlab.com/crafty-controller/crafty-4/-/issues/567

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.