the "template name" field of SQLView KRIS's Workflow Template feature
is rendered in "onclick" attributes on the main dashboard without
proper server-side sanitisation, allowing an attacker with administrative
access to inject and store malicious scripts that execute in the browsers of
affected users.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
No advisories yet.
Solution
SQLView, the product owner, has rolled out a fix for the reported vulnerability. Users and administrators of affected product versions are advised to update to the latest version promptly.
Workaround
No workaround given by the vendor.
Thu, 08 Oct 2026 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-79 |
Thu, 08 Oct 2026 08:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation, allowing an attacker with administrative access to inject and store malicious scripts that execute in the browsers of affected users. | |
| Title | Stored Cross-Site Scripting in SQLView KRIS | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CSA
Published:
Updated: 2026-10-08T08:22:53.338Z
Reserved: 2026-09-11T07:16:58.799Z
Link: CVE-2026-89191
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-08T09:16:42.413
Modified: 2026-10-08T09:16:42.413
Link: CVE-2026-89191
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-08T10:00:14Z