CVE-2021-31682: Automatedlogic Webctrl

Medium severity, CVSS 6.1. EPSS: 10.5% chance of exploitation in the next 30 days.

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization.

Affected products

• Automatedlogic Webctrl: up to and including 6.5

Published 2021-10-22. Last modified 2026-06-17.