CVE-2026-89191 — Stored Cross-Site Scripting in SQLView KRIS
Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side s…
Published: 2026-10-08 · CVSS: 6.8 · CVSS 3.1
Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation, allowing an attacker with administrative access to inject and store malicious scripts that execute in the browsers of affected users.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7