Crafty Controller Audit Logs Stored XSS via HTTP Header Injection

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection.

The flaw is triggered when attacker-controlled HTTP headers are logged without proper escaping, causing malicious script to be stored and later executed in the audit log view.

No authentication is required, and the attack can be carried out remotely.