craftycontrol records

8 published records for vendor craftycontrol.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 50%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

8 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
41Plan	CVE-2025-14700Proof of concept	Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controllercraftycontrol · crafty controller · CWE-1336 RCE SSTI	Critical9.9	—	6.5%	Dec 16, 2025
36Monitor	CVE-2026-13716No exploit	Path Traversal: '.../...//' in Crafty Controllercraftycontrol · crafty controller · CWE-35 RCE Path traversal	Critical9.1	—	0.8%	Aug 11, 2026
36Monitor	CVE-2026-5652No exploit	Authorization Bypass Through User-Controlled Key in Crafty Controllercraftycontrol · crafty controller · CWE-639 Broken access control (IDOR)	Critical9.0	—	0.5%	Apr 21, 2026
35Monitor	CVE-2026-0963No exploit	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controllercraftycontrol · crafty controller · CWE-22 RCE Path traversal	High8.8	—	0.7%	Jan 30, 2026
35Monitor	CVE-2026-0805No exploit	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controllercraftycontrol · crafty controller · CWE-22 RCE Path traversal	High8.8	—	0.6%	Jan 30, 2026
30Monitor	CVE-2024-1064No exploit	Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4craftycontrol · crafty controller · CWE-644 Pre-auth Denial of service	High7.5	—	0.8%	Feb 3, 2024
28Monitor	CVE-2025-14701No exploit	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controllercraftycontrol · crafty controller · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Dec 16, 2025
21Monitor	CVE-2025-5990No exploit	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controllercraftycontrol · crafty controller · CWE-79 XSS	Medium5.4	—	0.2%	Jun 15, 2025

CVE-2025-14700
41Plan
Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller
CriticalCVSS 9.9Proof of conceptEPSS 6%
- RCE
- SSTI
craftycontrol · crafty controllerDec 16, 2025
CVE-2026-13716
36Monitor
Path Traversal: '.../...//' in Crafty Controller
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Path traversal
craftycontrol · crafty controllerAug 11, 2026
CVE-2026-5652
36Monitor
Authorization Bypass Through User-Controlled Key in Crafty Controller
CriticalCVSS 9.0No exploitEPSS 0%
- Broken access control (IDOR)
craftycontrol · crafty controllerApr 21, 2026
CVE-2026-0963
35Monitor
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Path traversal
craftycontrol · crafty controllerJan 30, 2026
CVE-2026-0805
35Monitor
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Path traversal
craftycontrol · crafty controllerJan 30, 2026
CVE-2024-1064
30Monitor
Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
craftycontrol · crafty controllerFeb 3, 2024
CVE-2025-14701
28Monitor
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
craftycontrol · crafty controllerDec 16, 2025
CVE-2025-5990
21Monitor
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
MediumCVSS 5.4No exploitEPSS 0%
- XSS
craftycontrol · crafty controllerJun 15, 2025