the "template name" field of SQLView KRIS's Workflow Template feature
is rendered in "onclick" attributes on the main dashboard without
proper server-side sanitisation, allowing an attacker with administrative
access to inject and store malicious scripts that execute in the browsers of
affected users.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| SQLView | SQLView KRIS | unknown |
|
No data.
No data.
No data available yet.
Vendor Solution
SQLView, the product owner, has rolled out a fix for the reported vulnerability. Users and administrators of affected product versions are advised to update to the latest version promptly.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 08 Oct 2026 08:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation, allowing an attacker with administrative access to inject and store malicious scripts that execute in the browsers of affected users. | |
| Title | Stored Cross-Site Scripting in SQLView KRIS | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CSA
Published:
Updated: 2026-10-08T08:22:53.338Z
Reserved: 2026-09-11T07:16:58.799Z
Link: CVE-2026-89191
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
No weakness.