CVE-2025-5990 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via …
Published: 2025-06-15 · CVSS: 7.6 · CVSS 3.1
An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7