CVE-2026-72743

Received Received - Intake

Stored XSS in SQLBot Dashboard via Unsanitized TinyMCE Output

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulnCheck

Description

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72743

EUVD

EUVD-2026-55801

Affected Vendors & Products

Vendor	Product	Version / Range
sqlbot	sqlbot	1.10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

SQLBot through version 1.10.0 has a stored cross-site scripting (XSS) vulnerability in the SQText dashboard component. The issue occurs because TinyMCE output is rendered via v-html without proper sanitization, allowing attackers with access to modify dashboard text widget content to inject malicious HTML and JavaScript code.

Detection Guidance

Check for SQLBot versions before 1.10.0 or commit c3f40a5. Inspect dashboard text widgets for unsanitized TinyMCE output. Look for HTML/JS injection in rendered content.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary scripts in the context of other users' browsers when they view the compromised dashboard. This may lead to session hijacking, unauthorized actions on behalf of users, or theft of sensitive data displayed on the dashboard.

Compliance Impact

This vulnerability could lead to unauthorized access or disclosure of personal data, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding protected health information. Organizations may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Upgrade SQLBot to version 1.10.0 or later. Apply input sanitization to TinyMCE output. Restrict dashboard text widget modifications to trusted users.

Hi! I’m here to help you understand CVE-2026-72743. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70