CVE-2026-109565

Received Received - Intake

Stored XSS in Rapyd Admin via Self-Registered Display Names

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109565

Affected Vendors & Products

Vendor	Product	Version / Range
zofe	rapyd-admin	9.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Rapyd Admin versions 9.4.0 to 9.20.0 have a stored cross-site scripting (XSS) flaw. Unauthenticated attackers can register with a malicious display name containing HTML or JavaScript code. This name is then rendered unescaped in the Activity log's Author filter, allowing script execution in an administrator's session when they view the log.

Detection Guidance

Check Rapyd Admin logs for suspicious HTML or JavaScript in display names. Look for unescaped scripts in the Activity log Author filter. Manually review user registrations for unusual names containing HTML/JS payloads.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of administrators, or deface the application. Since it targets admin sessions, it may lead to full system compromise, data theft, or unauthorized administrative changes.

Compliance Impact

This XSS flaw could expose sensitive user data, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations may face fines or penalties for failing to protect data integrity and confidentiality.

Mitigation Strategies

Upgrade Rapyd Admin to version 9.20.0 or later. Implement input validation to block HTML/JS in display names. Review and remove any existing malicious user registrations.

Hi! I’m here to help you understand CVE-2026-109565. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70