Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-90821 EUVD-2026-102872GHSA-v36h-wgjh-vc9p

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

Published Oct 16, 2026 · Updated Oct 16, 2026 · Assigned by GitLab

Description

An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input

Affected products

VendorProductAffectedFixed
Arcadia Technology Crafty Controller 4.2.0 – < 4.11.0 4.11.0

References