Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-72743

SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

dataease SQLBot

Default version status: affected

  • 0 to ≤ 1.10.0affected
  • c3f40a5c05a53253b2924765b02b83f6a819948funaffected
pkg:github/dataease/SQLBot

References