Craftycontrol
Vulnerability activity for Craftycontrol: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 1
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 6
- Critical (CVSS 9+)
- 4
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 9.1CriticalAug 11, 2026Craftycontrol crafty controller Path traversal / file handlingCVE-2026-13716Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
- 9.0CriticalApr 21, 2026Craftycontrol crafty controller Auth bypass / access controlCVE-2026-5652An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
- 9.9CriticalJan 30, 2026Craftycontrol crafty controller Path traversal / file handlingCVE-2026-0963An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.
- 8.2HighJan 30, 2026Craftycontrol crafty controller Path traversal / file handlingCVE-2026-0805An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.
- 7.1HighDec 17, 2025Craftycontrol crafty controller XSSCVE-2025-14701An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.
- 9.9CriticalDec 17, 2025Craftycontrol crafty controller Code / command injectionCVE-2025-14700An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.6.6% likely
Top products
- crafty controller6 CVEs in the last year, 4 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.