CVE-2025-5990: Arcadia Technology Crafty Controller · Cross-site Scripting
Affects Arcadia Technology Crafty ControllerSource CVE Database V5
Not known to be exploited · CVSS 7.6 High.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 15 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubcrafty-controller/craftypkg:github/crafty-controller/craftyOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
- Immediate mitigation should include restricting access to the Crafty Controller interface to trusted networks and users, minimizing the number of accounts with privileges to input data into the vulnerable forms.
- Implement strict input validation and output encoding on the Server Name and API Key fields at the application or web server level as a temporary measure, for example by deploying a Web Application Firewall (WAF) with custom rules to detect and block typical XSS payloads targeting these inputs.
- Educate users and administrators about the risk of phishing and social engineering that could lead to triggering stored XSS payloads, emphasizing caution when interacting with unexpected or suspicious inputs.
- Monitor logs and user activity for unusual behavior that could indicate exploitation attempts, such as unexpected script execution or anomalous API key changes.
- Coordinate with Arcadia Technology, LLC to obtain patches or updates as soon as they become available, and prioritize timely application of these patches.
- Consider implementing Content Security Policy (CSP) headers to reduce the impact of potential XSS by restricting script execution sources.
- Conduct a thorough review of user privileges and remove unnecessary authenticated access to reduce the attack surface.
- If feasible, isolate the Crafty Controller environment from critical networks until the vulnerability is remediated.
Description
An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input.