CVE-2026-19110

Received Received - Intake

Cross-Site Scripting in DataGear up to 5.0.0

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulDB

Description

A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-19110

Affected Vendors & Products

Vendor	Product	Version / Range
datagear	datagear	to 5.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in DataGear versions up to 5.0.0. It exists in the HtmlTplDashboardWidgetHtmlRenderer.java file, specifically in the Chart Name Handler component. The flaw allows attackers to inject malicious scripts via the Title argument, which is then rendered unsafely in the application.

Detection Guidance

Detection involves checking for reflected cross-site scripting (XSS) in DataGear versions up to 5.0.0. Inspect HTTP responses for unsanitized user input in chart title parameters. Use tools like Burp Suite or OWASP ZAP to scan for XSS vulnerabilities in DataGear endpoints.

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript in a victim's browser when they view a crafted chart title. This may lead to session hijacking, data theft, or defacement of the application. The attack is remote and requires user interaction, such as clicking a malicious link.

Compliance Impact

This XSS vulnerability could compromise data confidentiality and integrity, violating GDPR's principles of data protection and HIPAA's security requirements for safeguarding sensitive health information. Organizations may face compliance violations if exploited.

Mitigation Strategies

Upgrade DataGear to a version beyond 5.0.0 if available. If no patch exists, disable the affected component (HtmlTplDashboardWidgetHtmlRenderer) or restrict user input in chart titles. Implement input validation and output encoding to prevent XSS.

Hi! I’m here to help you understand CVE-2026-19110. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70