Crafty Controller
Monthly
Stored cross-site scripting in the Audit Logs component of Crafty Controller (the crafty-4 project by Arcadia Technology, LLC) allows an unauthenticated remote attacker to plant script payloads through attacker-influenced HTTP header values that the panel writes into its audit entries, with the payload executing in the browser of a privileged administrator who later opens the Audit Logs view. Per the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), the planting step requires no authentication, but realistic impact depends on the web interface being reachable from the attacker's network path and on an administrator actually viewing the poisoned log entry, which is the primary limiting factor. No public exploit identified at time of analysis, no CISA KEV listing is present in the supplied data, and no EPSS score was provided; exact affected and fixed versions are not stated in the available data.
Remote code execution in Crafty Controller (crafty-4), a web-based management panel for Minecraft servers, arises from path traversal in the server-import and admin file-upload features that lets an authenticated user write files to arbitrary filesystem paths accessible to the application. By planting a file in an executable or auto-loaded location, a low-privileged authenticated attacker can escalate to code execution in the context of the Crafty Controller process. No public exploit has been identified at the time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Crafty Controller Users API allows authenticated administrators with high privileges to modify other user accounts due to improper API permission validation. Despite requiring PR:H (high privileges) and authentication, the vulnerability achieves CVSS 9.0 due to scope change, enabling privilege escalation and potential system-wide compromise. GitLab reports this as an authentication bypass affecting Crafty Controller by Arcadia Technology, LLC. No CISA KEV listing or public exploit code identified at time of analysis, though the authentication bypass tag suggests deviation from intended access controls even for privileged users.
Path traversal in Crafty Controller game server management allows authenticated attackers to read/write files outside the intended directory. CVSS 9.9 with scope change.
Remote code execution in Crafty Controller's Backup Configuration feature results from insufficient path traversal validation, enabling authenticated attackers to manipulate files and execute arbitrary code on affected systems. The vulnerability requires valid credentials and specific conditions to exploit but carries high impact due to its ability to compromise system integrity and confidentiality. No patch is currently available.
Stored cross-site scripting in the Webhook URL form field of Crafty Controller allows an authenticated user with access to that configuration field to persist malicious input that executes in the browser of any other user who later views the affected page. The vulnerability is assessed at CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), meaning a valid low-privileged account is required (PR:L) and a separate victim must load the rendering view (UI:R); the attacker cannot trigger impact on their own session, and no public exploit code was identified at time of analysis. Exploitation is most damaging when a higher-privileged operator such as an administrator views the poisoned webhook view, but this is a genuinely moderate, not high-priority, issue and no anonymous or pre-authentication path exists.
Stored cross-site scripting (CWE-79) in the Server MOTD component of Crafty Controller, a self-hosted Minecraft server management panel, allows a remote, unauthenticated attacker to submit a crafted MOTD that is stored by the application and later rendered in the browser of any logged-in panel user who views the affected page (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R). Because the payload fires only in the viewing user's browser session, the practical impact is limited to confidentiality and integrity compromise of that session rather than server takeover, and the vulnerability affects a niche, self-hosted product with limited deployment plus no published affected/fixed version boundary to scope exposure. No public exploit code has been identified at time of analysis and the EPSS score is low at 0.29% (19th percentile) with no CISA KEV listing, so there is currently no evidence of active exploitation.
Stored cross-site scripting (XSS) vulnerability in Crafty Controller that allows authenticated attackers to inject malicious JavaScript through the Server Name form and API Key form components. An attacker with valid credentials can craft malicious input that persists in the application, executing arbitrary scripts in other users' browsers with the same security context. While CVSS 7.6 indicates high severity and the vulnerability requires low attack complexity with network accessibility, real-world risk is constrained by the requirement for prior authentication and user interaction.
A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in the Audit Logs component of Crafty Controller (the crafty-4 project by Arcadia Technology, LLC) allows an unauthenticated remote attacker to plant script payloads through attacker-influenced HTTP header values that the panel writes into its audit entries, with the payload executing in the browser of a privileged administrator who later opens the Audit Logs view. Per the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), the planting step requires no authentication, but realistic impact depends on the web interface being reachable from the attacker's network path and on an administrator actually viewing the poisoned log entry, which is the primary limiting factor. No public exploit identified at time of analysis, no CISA KEV listing is present in the supplied data, and no EPSS score was provided; exact affected and fixed versions are not stated in the available data.
Remote code execution in Crafty Controller (crafty-4), a web-based management panel for Minecraft servers, arises from path traversal in the server-import and admin file-upload features that lets an authenticated user write files to arbitrary filesystem paths accessible to the application. By planting a file in an executable or auto-loaded location, a low-privileged authenticated attacker can escalate to code execution in the context of the Crafty Controller process. No public exploit has been identified at the time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Crafty Controller Users API allows authenticated administrators with high privileges to modify other user accounts due to improper API permission validation. Despite requiring PR:H (high privileges) and authentication, the vulnerability achieves CVSS 9.0 due to scope change, enabling privilege escalation and potential system-wide compromise. GitLab reports this as an authentication bypass affecting Crafty Controller by Arcadia Technology, LLC. No CISA KEV listing or public exploit code identified at time of analysis, though the authentication bypass tag suggests deviation from intended access controls even for privileged users.
Path traversal in Crafty Controller game server management allows authenticated attackers to read/write files outside the intended directory. CVSS 9.9 with scope change.
Remote code execution in Crafty Controller's Backup Configuration feature results from insufficient path traversal validation, enabling authenticated attackers to manipulate files and execute arbitrary code on affected systems. The vulnerability requires valid credentials and specific conditions to exploit but carries high impact due to its ability to compromise system integrity and confidentiality. No patch is currently available.
Stored cross-site scripting in the Webhook URL form field of Crafty Controller allows an authenticated user with access to that configuration field to persist malicious input that executes in the browser of any other user who later views the affected page. The vulnerability is assessed at CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), meaning a valid low-privileged account is required (PR:L) and a separate victim must load the rendering view (UI:R); the attacker cannot trigger impact on their own session, and no public exploit code was identified at time of analysis. Exploitation is most damaging when a higher-privileged operator such as an administrator views the poisoned webhook view, but this is a genuinely moderate, not high-priority, issue and no anonymous or pre-authentication path exists.
Stored cross-site scripting (CWE-79) in the Server MOTD component of Crafty Controller, a self-hosted Minecraft server management panel, allows a remote, unauthenticated attacker to submit a crafted MOTD that is stored by the application and later rendered in the browser of any logged-in panel user who views the affected page (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R). Because the payload fires only in the viewing user's browser session, the practical impact is limited to confidentiality and integrity compromise of that session rather than server takeover, and the vulnerability affects a niche, self-hosted product with limited deployment plus no published affected/fixed version boundary to scope exposure. No public exploit code has been identified at time of analysis and the EPSS score is low at 0.29% (19th percentile) with no CISA KEV listing, so there is currently no evidence of active exploitation.
Stored cross-site scripting (XSS) vulnerability in Crafty Controller that allows authenticated attackers to inject malicious JavaScript through the Server Name form and API Key form components. An attacker with valid credentials can craft malicious input that persists in the application, executing arbitrary scripts in other users' browsers with the same security context. While CVSS 7.6 indicates high severity and the vulnerability requires low attack complexity with network accessibility, real-world risk is constrained by the requirement for prior authentication and user interaction.
A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.