CVE-2026-110239

Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in Rapyd Admin via Unsanitized Rich-Text Component

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110239

EUVD

EUVD-2026-99023

Affected Vendors & Products

Vendor	Product	Version / Range
zofe	rapyd-admin	0.4.0
zofe	rapyd-admin	0.8.5
zofe	rapyd-admin	1.0.0
zofe	rapyd-admin	1.1.0
zofe	rapyd-admin	9.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Rapyd Admin versions before 9.20.0. The x-rpd::rich-text Blade component outputs bound model values as raw HTML without sanitization. Authenticated users can inject JavaScript via the Livewire client API, which executes when administrators view the record's form.

Detection Guidance

Check for installed versions of Rapyd Admin prior to 9.20.0. Inspect rich-text fields in forms for stored JavaScript or HTML markup. Review Livewire client API calls for suspicious property bindings. Examine admin panel forms for unexpected script execution.

Impact Analysis

An attacker could steal session cookies, perform unauthorized actions on behalf of administrators, or exfiltrate sensitive data. Since the script executes when an admin views a record, it could lead to account compromise or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, triggering mandatory breach notifications and potential fines.

Mitigation Strategies

Update Rapyd Admin to version 9.20.0 or later. Change the default admin password (admin@laravel) to a strong, unique value. Review all user names and rich-text values for malicious content. Remove or sanitize any suspicious markup in stored data.

Hi! I’m here to help you understand CVE-2026-110239. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70