the "template name" field of SQLView KRIS's Workflow Template feature
is rendered in "onclick" attributes on the main dashboard without
proper server-side sanitisation, allowing an attacker with administrative
access to inject and store malicious scripts that execute in the browsers of
affected users.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| SQLView | SQLView KRIS | unknown |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
SQLView, the product owner, has rolled out a fix for the reported vulnerability. Users and administrators of affected product versions are advised to update to the latest version promptly.
Workaround
No workaround given by the vendor.
Thu, 08 Oct 2026 08:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation, allowing an attacker with administrative access to inject and store malicious scripts that execute in the browsers of affected users. | |
| Title | Stored Cross-Site Scripting in SQLView KRIS | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CSA
Published:
Updated: 2026-10-08T08:22:53.338Z
Reserved: 2026-09-11T07:16:58.799Z
Link: CVE-2026-89191
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
No weakness.