CVE-2025-5990: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5990?
CVE-2025-5990 is considered a moderate severity vulnerability due to its potential for allowing stored XSS attacks.
How do I fix CVE-2025-5990?
To fix CVE-2025-5990, ensure that input sanitization is properly implemented in the Server Name and API Key form components.
Who is affected by CVE-2025-5990?
CVE-2025-5990 affects users of Crafty Controller when handling input in the specified form components.
What can an attacker do with CVE-2025-5990?
An attacker can exploit CVE-2025-5990 to perform stored XSS, which may lead to unauthorized actions on behalf of users.
Is CVE-2025-5990 an authenticated vulnerability?
Yes, CVE-2025-5990 requires remote authentication to exploit, as the attacker must be logged into the system.