CVE-2025-5990: Craftycontrol Crafty Controller

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input.

Affected products

• Craftycontrol Crafty Controller: from 4.3.0, before 4.3.2 (fixed in 4.3.2); from 4.4.0, before 4.4.10 (fixed in 4.4.10); version 4.2.0 only

Published 2025-06-15. Last modified 2026-06-17.