CVE-2026-109565mediumCWE-79

CVE-2026-109565: falha de média gravidade em zofe rapyd-admin

Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar rapyd-admin

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.2%
Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
zofe · rapyd-admin
CVEs relacionadas — zofe rapyd-admin

No mesmo produto, das mais perigosas para as menos.

CVE-2026-110238HIGHRapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed ComponentEPSS 0.5%CVE-2026-109566CRITICALRapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeederEPSS 0.4%CVE-2026-109567HIGHRapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit ComponentEPSS 0.3%CVE-2026-110239LOWRapyd Admin before 9.20.0 Stored XSS via rich-text ComponentEPSS 0.2%