CVE-2026-19110: DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting
A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19110?
The severity of CVE-2026-19110 is classified as low.
How does CVE-2026-19110 affect DataGear?
CVE-2026-19110 allows for cross site scripting due to manipulation of the Title argument in the HtmlTplDashboardWidgetHtmlRenderer function.
What is the risk associated with CVE-2026-19110?
CVE-2026-19110 has a risk rating of 17, indicating a low but notable concern.
How can I mitigate CVE-2026-19110?
To mitigate CVE-2026-19110, ensure proper validation and sanitization of input in the HtmlTplDashboardWidgetHtmlRenderer function.
Which version of DataGear is affected by CVE-2026-19110?
CVE-2026-19110 affects DataGear versions up to 5.0.0.