CVE-2025-14700-poc

CVE-2025-14700 POC Crafty Controller --login --password --lhost --lport 此脚本使用 netcat 在触发反向 Shell 载荷后设置监听器。如果您的监听机器上没有 netcat，它将无法工作。...

POC_CVE-2025-14700

CVE-2025-14700 用于 CVE-2025-14700 的概念验证（PoC）利用程序，该漏洞是 Crafty Controller = 4.6.1 中的一个服务端模板注入（SSTI）漏洞。允许经过身份验证的用户通过向 Webhook 配置中注入恶意 Jinja2 模板来实现远程代码执行（RCE）。 📦 安装 克隆仓库 git clone https://github.com/secdongle/POCCVE-2025-14700 cd POCCVE-2025-14700 🛠️ 测试环境（Docker Compose） 要搭建一个存在漏洞的 Crafty Controller...

CVE-2026-13716

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution...

CVE-2026-13716 Path Traversal: '.../...//' in Crafty Controller

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution...

CVE-2026-13716

Crafty Controller is affected by CVE-2026-13716, which exposes a path traversal vulnerability in server import and admin file upload. The issue allows a remote, authenticated attacker to upload files to arbitrary paths that the Crafty Controller application can access, enabling remote code execut...

CVE-2026-13716 Path Traversal: '.../...//' in Crafty Controller

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution...

CVE-2026-13716

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution...

EUVD-2026-55949

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution...

CVE-2026-13716: Path Traversal: '.../...//'

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution...

PT-2026-70064

Name of the Vulnerable Software and Affected Versions Crafty Controller affected versions not specified Description Path traversal exists in the server import and admin file upload features. This allows a remote, authenticated attacker to upload files to arbitrary paths accessible to the...

CVE-2026-5652

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation...

Arcadia Crafty Controller 安全漏洞

Arcadia Crafty Controller is a server management panel developed under the open-source Crafty Controller project. There is a security vulnerability in Arcadia Crafty Controller. This vulnerability stems from a lack of resilience to unexpected messages from connection switches, which may lead to...

EUVD-2026-24199

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation...

CVE-2026-5652

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation...

CVE-2026-5652

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation...

CVE-2026-5652 Authorization Bypass Through User-Controlled Key in Crafty Controller

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation...

CVE-2026-5652

CVE-2026-5652 affects Crafty Controller’s Users API component, enabling an authenticated remote attacker to perform user modification actions due to improper API permissions validation. Reported CVSS 3.1 base score 9.0 (CRITICAL) with network attack vector, low attack complexity, high confidentia...

CVE-2026-5652 Authorization Bypass Through User-Controlled Key in Crafty Controller

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation...

CVE-2026-5652: Authorization Bypass Through User-Controlled Key

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation...

Crafty Controller 安全漏洞

Crafty Controller is a Minecraft server control panel/ launcher for Arcadia. There is a security vulnerability in Crafty Controller, which stems from improper permission verification in the Users API component. This vulnerability could allow remotely authenticated attackers to execute user-modifi...