CVE-2026-18516 — Improper Encoding or Escaping of Output in Crafty Controller
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP heade…
Published: 2026-10-16 · CVSS: 9.6 · CVSS 3.1
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7