Skip to content
CVE PROGRAM SOURCE RECORD9.6 Critical

CVE-2026-18516

Improper Encoding or Escaping of Output in Crafty Controller

Description

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Arcadia Technology, LLC Crafty Controller

Default version status: unaffected

  • 0 to ≤ 4.10.8affected

References