CVE-2026-89191: Stored Cross-Site Scripting in SQLView KRIS
Published Oct 8, 2026
·Updated
Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation, allowing an attacker with administrative access to inject and store malicious scripts that execute in the browsers of affected users.
Affected Software
1 affected component
SQLView KRIS
Event History
Oct 8, 2026
CVE Published
via MITRE·08:15 AM
Data Sourced
via MITRE·08:15 AM
RemedyDescriptionSeverity
Data Sourced
via NVD·09:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require another user to interact with the application?
Yes. The injected script is stored and executes when affected users load the main dashboard, so a user must view that dashboard for the payload to run in their browser.
2
What is the potential impact if the script executes?
The supplied CVSS vector rates confidentiality, integrity, and availability impacts as high. The vulnerability can therefore affect all three security properties in the context of the affected user's browser session.