High · 7.1 CVE-2025-14701 EUVD-2025-203860GHSA-8376-84xq-6jjp

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

Published Dec 17, 2025 · Updated Dec 17, 2025 · Assigned by GitLab

Vendor: Arcadia Technology Product: Crafty Controller

Description

An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.

Affected products

Vendor	Product	Affected	Fixed
Arcadia Technology	Crafty Controller	< 4.6.2	4.6.2

References

GitLab Issue #647 issue-tracking permissions-required