{"id":"CVE-2026-89191","state":"PUBLISHED","title":"Stored Cross-Site Scripting in SQLView KRIS","description":"Unsanitised input in\nthe \"template name\" field of SQLView KRIS's Workflow Template feature\nis rendered in \"onclick\" attributes on the main dashboard without\nproper server-side sanitisation, allowing an attacker with administrative\naccess to inject and store malicious scripts that execute in the browsers of\naffected users.","publishedAt":"2026-10-08T08:15:14.655Z","updatedAt":"2026-10-09T03:15:59.465Z","severity":{"score":6.8,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","source":"CSA"},"assigner":"CSA","products":["SQLView SQLView KRIS"],"affected":[{"vendor":"SQLView","product":"SQLView KRIS","defaultStatus":"unknown","versions":[{"version":"4.6.4.4 and below","status":"affected"}]}],"references":["https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-136/"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89191.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89191","state":"PUBLISHED","datePublished":"2026-10-08T08:15:14.655Z","dateUpdated":"2026-10-09T03:15:59.465Z","assignerShortName":"CSA","assignerOrgId":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","dateReserved":"2026-09-11T07:16:58.799Z"},"containers":{"cna":{"title":"Stored Cross-Site Scripting in SQLView KRIS","descriptions":[{"lang":"en","value":"Unsanitised input in\nthe \"template name\" field of SQLView KRIS's Workflow Template feature\nis rendered in \"onclick\" attributes on the main dashboard without\nproper server-side sanitisation, allowing an attacker with administrative\naccess to inject and store malicious scripts that execute in the browsers of\naffected users."}],"affected":[{"vendor":"SQLView","product":"SQLView KRIS","defaultStatus":"unknown","versions":[{"version":"4.6.4.4 and below","status":"affected"}]}],"references":[{"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-136/"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"MEDIUM","baseScore":6.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"}}],"providerMetadata":{"shortName":"CSA","orgId":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","dateUpdated":"2026-10-09T03:15:59.465Z"},"datePublic":"2026-10-08T08:07:00.000Z","solutions":[{"lang":"en","value":"SQLView, the product\nowner, has rolled out a fix for the reported vulnerability. Users and\nadministrators of affected product versions are advised to update to the latest\nversion promptly.","supportingMedia":[{"type":"text/html","base64":false,"value":"SQLView, the product\nowner, has rolled out a fix for the reported vulnerability. Users and\nadministrators of affected product versions are advised to update to the latest\nversion promptly."}]}],"credits":[{"lang":"en","value":"Yong Kai Wen","type":"reporter"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-08T13:18:07.526627Z","id":"CVE-2026-89191","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-08T13:18:14.972Z"}}]}}}