AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-72743

MEDIUM · CVSS 5.4 EPSS 0.17% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

The SQLBot dashboard component in versions up to 1.10.0 is vulnerable to a stored cross-site scripting (XSS) attack due to improper sanitization of TinyMCE output. This allows attackers with access to modify dashboard text widgets to inject malicious HTML and JavaScript, impacting all users who view the dashboard. Organizations using affected versions should prioritize patching to mitigate potential exploitation risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-72743
Severity
MEDIUM
CVSS
5.4
EPSS
0.17%
Java

Original NVD Description

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.