CVE-2026-72743

MediumCVSS 5.4

Published: 10/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 11/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

SQLBot through 1.10.0 contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.

Risk Assessment

Risk of session theft, account takeover, and spreading malicious code across the organization.

Recommendation

Update SQLBot to a patched version (commit c3f40a5) and sanitize data before rendering via v-html.

Original NVD description (English source)

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.