CVE-2026-72743CWE-79cross-site-scripting

CVE-2026-72743

Medium · published August 11, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00298 · 21.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-11T01:17Z
References (4)
https://github.com/dataease/SQLBot/commit/c3f40a5c05a53253b2924765b02b83f6a819948f · [email protected]https://github.com/dataease/SQLBot/issues/1308 · [email protected]https://github.com/dataease/SQLBot/pull/1309 · [email protected]https://www.vulncheck.com/advisories/sqlbot-sqtext-dashboard-component-stored-xss-via-v-html · [email protected]
EPSS history
Timeline
  • 10 AUG 20:06Z
    SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html
    cvelistv5