CVE-2025-14701 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

Back Back to CVE browser

HIGH

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

Published Dec 17, 2025

7.1

HIGH

CVSS 3.1

EPSS 0.29%

Description

An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.

Affected products

Vendor Arcadia Technology, LLC Product Crafty Controller Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <4.6.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Arcadia Technology, LLC

Crafty Controller

unaffected

Version	Status	Constraints
0	affected	<4.6.2

Remediation

Vendor solution

Upgrade to version 4.6.2

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (1)

https://gitlab.com/crafty-controller/crafty-4/-/issues/647
issue-trackingpermissions-requiredBroken Link

Link	Providers	Tags
https://gitlab.com/crafty-controller/crafty-4/-/issues/647		issue-trackingpermissions-requiredBroken Link

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitLab

Published Dec 17, 2025

Updated Dec 17, 2025

Reserved Dec 14, 2025

Link CVE-2025-14701

CISA Vulnrichment

Updated Dec 17, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-14701

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-14701