CVE-2025-14700
Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller
CRITICAL 9.9EPSS 6.6%
An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.
- Affected
- Arcadia Technology, LLC · Crafty Controller
- CVSS v3.1 GITLAB
- 9.9 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - EPSS
- 6.56% chance of exploitation in the next 30 days, 94th percentile
- Published
- 2025-12-17
Proof-of-concept exploits (2)
- Nosiume/CVE-2025-14700-poc1★ · 2025-12-17
- secdongle/POC_CVE-2025-147000★ · 2025-12-18