CVE-2025-14700

An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.

CVSS v3.1

9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

6.65% chance of exploitation in the next 30 days, 93th percentile

Published

2025-12-17

Proof-of-concept exploits (2)

• Nosiume/CVE-2025-14700-poc
• secdongle/POC_CVE-2025-14700

References

• CVE Record
• NVD entry

Related

• CVE-2025-68055
• CVE-2025-69194
• CVE-2025-14699
• CVE-2025-14702
• CVE-2025-14698
• CVE-2025-14703