CVE-2026-109565 — Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component
Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display…
Published: 2026-10-12 · CVSS: 5.3 · CVSS 4.0
Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7