CVE-2026-90821

MEDIUM 5.4

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input

CWE	CWE-79
Vendor	arcadia technology, llc
Product	crafty controller
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for arcadia technology, llc crafty controller

Be the first to know when new medium vulnerabilities affecting arcadia technology, llc crafty controller are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Arcadia Technology, LLC / Crafty Controller

4.2.0 < 4.11.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

gitlab.com: https://gitlab.com/crafty-controller/crafty-4/-/work_items/745

Credits

Thank you to [Kacper Leszczyński / szotgan](https://gitlab.com/szotgan) on GitLab for reporting this issue.