Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by SQLView

    CVE-2026-89191 (GCVE-0-2026-89191)

    Vulnerability from nvd – Published: 2026-10-08 08:15 – Updated: 2026-10-09 03:15
    VLAI
    Title
    Stored Cross-Site Scripting in SQLView KRIS
    Summary
    Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation, allowing an attacker with administrative access to inject and store malicious scripts that execute in the browsers of affected users.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-08 13:18 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    CSA CNA under the mitre root
    CNA scorecard D 55/100 over 33 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    SQLView SQLView KRIS Affected: 4.6.4.4 and below
    		Create a notification for this product.
    Date Public
    2026-10-08 08:07
    Credits
    Yong Kai Wen
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89191",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T13:18:07.526627Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T13:18:14.972Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "SQLView KRIS",
          "vendor": "SQLView",
          "versions": [
            {
              "status": "affected",
              "version": "4.6.4.4 and below"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Yong Kai Wen"
        }
      ],
      "datePublic": "2026-10-08T08:07:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unsanitised input in\nthe \"template name\" field of SQLView KRIS\u0027s Workflow Template feature\nis rendered in \"onclick\" attributes on the main dashboard without\nproper server-side sanitisation, allowing an attacker with administrative\naccess to inject and store malicious scripts that execute in the browsers of\naffected users."
            }
          ],
          "value": "Unsanitised input in\nthe \"template name\" field of SQLView KRIS\u0027s Workflow Template feature\nis rendered in \"onclick\" attributes on the main dashboard without\nproper server-side sanitisation, allowing an attacker with administrative\naccess to inject and store malicious scripts that execute in the browsers of\naffected users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T03:15:59.465Z",
        "orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
        "shortName": "CSA"
      },
      "references": [
        {
          "url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-136/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SQLView, the product\nowner, has rolled out a fix for the reported vulnerability. Users and\nadministrators of affected product versions are advised to update to the latest\nversion promptly."
            }
          ],
          "value": "SQLView, the product\nowner, has rolled out a fix for the reported vulnerability. Users and\nadministrators of affected product versions are advised to update to the latest\nversion promptly."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Stored Cross-Site Scripting in SQLView KRIS",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
    "assignerShortName": "CSA",
    "cveId": "CVE-2026-89191",
    "datePublished": "2026-10-08T08:15:14.655Z",
    "dateReserved": "2026-09-11T07:16:58.799Z",
    "dateUpdated": "2026-10-09T03:15:59.465Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-89191 (GCVE-0-2026-89191)

    Vulnerability from cvelistv5 – Published: 2026-10-08 08:15 – Updated: 2026-10-09 03:15
    VLAI
    Title
    Stored Cross-Site Scripting in SQLView KRIS
    Summary
    Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation, allowing an attacker with administrative access to inject and store malicious scripts that execute in the browsers of affected users.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-08 13:18 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    CSA CNA under the mitre root
    CNA scorecard D 55/100 over 33 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    SQLView SQLView KRIS Affected: 4.6.4.4 and below
    		Create a notification for this product.
    Date Public
    2026-10-08 08:07
    Credits
    Yong Kai Wen
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89191",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T13:18:07.526627Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T13:18:14.972Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "SQLView KRIS",
          "vendor": "SQLView",
          "versions": [
            {
              "status": "affected",
              "version": "4.6.4.4 and below"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Yong Kai Wen"
        }
      ],
      "datePublic": "2026-10-08T08:07:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unsanitised input in\nthe \"template name\" field of SQLView KRIS\u0027s Workflow Template feature\nis rendered in \"onclick\" attributes on the main dashboard without\nproper server-side sanitisation, allowing an attacker with administrative\naccess to inject and store malicious scripts that execute in the browsers of\naffected users."
            }
          ],
          "value": "Unsanitised input in\nthe \"template name\" field of SQLView KRIS\u0027s Workflow Template feature\nis rendered in \"onclick\" attributes on the main dashboard without\nproper server-side sanitisation, allowing an attacker with administrative\naccess to inject and store malicious scripts that execute in the browsers of\naffected users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T03:15:59.465Z",
        "orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
        "shortName": "CSA"
      },
      "references": [
        {
          "url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-136/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SQLView, the product\nowner, has rolled out a fix for the reported vulnerability. Users and\nadministrators of affected product versions are advised to update to the latest\nversion promptly."
            }
          ],
          "value": "SQLView, the product\nowner, has rolled out a fix for the reported vulnerability. Users and\nadministrators of affected product versions are advised to update to the latest\nversion promptly."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Stored Cross-Site Scripting in SQLView KRIS",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
    "assignerShortName": "CSA",
    "cveId": "CVE-2026-89191",
    "datePublished": "2026-10-08T08:15:14.655Z",
    "dateReserved": "2026-09-11T07:16:58.799Z",
    "dateUpdated": "2026-10-09T03:15:59.465Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}