CVE-2026-90821

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller PUBLISHED

Description (CNA)

An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input

Affected (CNA)

Vendor / product	Versions
Arcadia Technology, LLC / Crafty Controller	affected 4.2.0 before 4.11.0

CWE

CWE-79

References

https://gitlab.com/crafty-controller/crafty-4/-/work_items/745

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.