CVE-2026-89191
Last modified
CVE-2026-89191 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation, allowing an attacker with administrative access to inject and store malicious scripts that execute in the browsers of affected users.. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation, allowing an attacker with administrative access to inject and store malicious scripts that execute in the browsers of affected users.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| SQLView | SQLView KRIS | 4.6.4.4 and below |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-89191?
How severe is CVE-2026-89191?
How do I fix CVE-2026-89191?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-8918A permissive list of allowed inputs in ASUS Armoury Crate al…7.1
- CVE-2026-89180EFence developed by Thinking Software Technology has a SQL I…7.5
- CVE-2026-89182With `[repository] FORCE_PRIVATE = true`, Gitea creates new …5.4
- CVE-2026-89186Use of Cache Containing Sensitive Information in ZenHive mpp…6.3
- CVE-2026-8919Permissive Cross-domain Security Policy with Untrusted Domai…7.2
- CVE-2026-89190The Robin Image Optimizer WordPress plugin before 2.0.8 doe…4.3
- CVE-2026-89193The Robin Image Optimizer WordPress plugin before 2.0.8 doe…7.5
- CVE-2026-89195The Site Setup Wizard WordPress plugin through 1.5.8 does no…8.6
- CVE-2026-89196A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…8.8
- CVE-2026-89197A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…8.8
- CVE-2026-89198A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…8.8
- CVE-2026-89199A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…8.8
Are you affected by CVE-2026-89191?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST