CVE-2026-119735
Deferred Deferred - Pending Action

Stored XSS in Munshi by Petpooja

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread (/purchase-inquiry/thread/{thread-id}), which is assigned to innerHTML during rendering before text cleaning completes. Attackers can store a payload that executes in the browser of another user who opens the affected thread, achieving JavaScript execution and full-page defacement that re-triggers whenever the thread is reopened.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-119735

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Petpooja Munshi 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Munshi (by Petpooja) before 2026-07-13. Authenticated users can inject malicious markup via item descriptions or messages in the Purchase Inquiry thread. The payload executes in other users' browsers when they view the thread, enabling JavaScript execution and page defacement.

Detection Guidance

This vulnerability involves stored cross-site scripting in Munshi (by Petpooja) before 2026-07-13, specifically through item descriptions or messages in the Purchase Inquiry thread. To detect it, inspect user-submitted content in /purchase-inquiry/thread/{thread-id} for untrusted JavaScript or HTML tags that may execute when rendered.

Impact Analysis

An attacker could steal session cookies, perform actions on your behalf, or deface the page. Users viewing infected threads risk data theft or malware delivery. The attack persists as the payload remains stored until manually removed.

Compliance Impact

This XSS flaw could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data security) by exposing sensitive user information. Compliance may require incident reporting and corrective measures.

Mitigation Strategies

Immediately update Munshi (by Petpooja) to version 2026-07-13 or later to patch the stored XSS vulnerability. Additionally, review and sanitize all user-generated content in Purchase Inquiry threads before rendering to prevent malicious markup execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119735. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...