CVE-2026-18516

Improper Encoding or Escaping of Output in Crafty Controller PUBLISHED

Description (CNA)

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection

Affected (CNA)

Vendor / product	Versions
Arcadia Technology, LLC / Crafty Controller	affected 0 through 4.10.8

CWE

CWE-116

References

https://gitlab.com/crafty-controller/crafty-4/-/work_items/743

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.