CVE-2026-109565
Last modified
CVE-2026-109565 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| zofe | rapyd-admin | >= 9.4.0, < 9.20.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-109565?
How severe is CVE-2026-109565?
How do I fix CVE-2026-109565?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-10956Use after free in MimeHandlerView in Google Chrome prior to …8.8
- CVE-2026-109560Continue CLI (@continuedev/cli) through 1.5.47 contains a pe…7.5
- CVE-2026-109561goose from 1.28.0 before 1.44.0 contains an authorization by…4.2
- CVE-2026-109562SnapOtter 1.15.10 through 2.2.0 contains a missing authoriza…5.4
- CVE-2026-109563N3.js before 2.11.1 contains a regular expression denial of …7.5
- CVE-2026-109564LearnHouse before 1.4.0 contains a missing authorization vul…3.1
- CVE-2026-109566Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded c…9.8
- CVE-2026-109567Rapyd Admin from 9.0.0 before 9.20.0 contains an improper pr…7.2
- CVE-2026-109568Shaark 1.2.13 through 1.2.44 contains a missing authorizatio…7.1
- CVE-2026-109569sandboxed.sh through 1.3.0 contains a container escape vulne…8.8
- CVE-2026-10957Use after free in Glic in Google Chrome prior to 149.0.7827.…8.8
- CVE-2026-109570Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contain…4.3
Are you affected by CVE-2026-109565?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST