CVE-2026-90821
CVE-2026-90821 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input
CVSS 5.4 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
crafty controller
- Versions
- ≥ 4.2.0, < 4.11.0: Affected (semver)
Update to 4.11.0