CVE-2026-18516: falha crítica em Arcadia Technology, LLC Crafty Controller
Improper Encoding or Escaping of Output in Crafty Controller
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.6epss 0.3%
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
Arcadia Technology, LLC · Crafty ControllerCVEs relacionadas — Arcadia Technology, LLC Crafty Controller
No mesmo produto, das mais perigosas para as menos.
CVE-2025-14700CRITICALImproper Neutralization of Special Elements Used in a Template Engine in Crafty ControllerEPSS 6.6%CVE-2024-1064HIGHImproper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4EPSS 0.8%CVE-2026-13716CRITICALPath Traversal: '.../...//' in Crafty ControllerEPSS 0.8%CVE-2026-0963CRITICALImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty ControllerEPSS 0.7%CVE-2026-0805HIGHImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty ControllerEPSS 0.7%CVE-2026-5652CRITICALAuthorization Bypass Through User-Controlled Key in Crafty ControllerEPSS 0.4%