CVE-2026-18516

Published: Ott 16, 2026 Last Modified: Ott 18, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,6
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0029
Percentile
0,2th
Updated

EPSS Score Trend (Last 3 Days)

116

Improper Encoding or Escaping of Output

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability Access Control
Potential Impacts:
Modify Application Data Execute Unauthorized Code Or Commands Bypass Protection Mechanism
Applicable Platforms
Technologies: Not Technology-Specific, AI/ML, Database Server, Web Server
Likelihood of Exploit: High
View CWE Details
https://gitlab.com/crafty-controller/crafty-4/-/work_items/…
https://gitlab.com/crafty-controller/crafty-4/-/work_items/743