CVE Catalog
CVE-2025-14700
CriticalSummary
An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.
Risk Assessment
An authenticated attacker can execute arbitrary code on the server, potentially leading to full control of the application and data breach.
Recommendation
Upgrade Crafty Controller to the latest version with the fix and restrict user privileges.
Original NVD description (English source)
An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.