DataGear CVE-2026-19110

Q: What is the CVSS score of CVE-2026-19110?

CVE-2026-19110 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54146 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 cna@vuldb.com

GHSA-c3j6-vwpc-wjgh

XSS Java

1.9

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

High privileges required to inject; scope changes to victim browser (S:C); low C and I reflect session-level impact typical of XSS; no availability impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 23:30 vuln.today

DescriptionCVE.org

A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stored cross-site scripting in DataGear up to version 5.0.0 allows a high-privileged authenticated attacker to inject malicious script into dashboard chart titles, which executes in the browser of any user who subsequently views the affected dashboard. The vulnerability resides in HtmlTplDashboardWidgetHtmlRenderer.java within the Chart Name Handler, where the Title argument is rendered without adequate output encoding. A proof-of-concept has been publicly disclosed; the vendor did not respond to pre-disclosure contact, meaning no official patch is confirmed at time of analysis.

Technical ContextAI

DataGear is a Java-based open-source data visualization and BI dashboard platform. The vulnerable component, HtmlTplDashboardWidgetHtmlRenderer, is responsible for rendering HTML template-based dashboard widgets, including chart titles. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the root cause: user-supplied input in the Title argument is written into the rendered HTML output without sanitization or contextual encoding, creating a persistent (stored) XSS sink. Because chart configurations are persisted server-side and served to all viewers of a dashboard, injected payloads survive across sessions. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:P confirms network delivery, no special attack prerequisites, high privilege for injection, and passive victim interaction for payload execution.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to pre-disclosure contact. Organizations running DataGear up to 5.0.0 should treat the fix as unconfirmed until a vendor advisory is issued. As a compensating control, restrict Chart Name / Title editing permissions exclusively to fully trusted administrator accounts, reducing the PR:H attack surface to the smallest possible set of users. Additionally, deploy a Content Security Policy (CSP) header on the DataGear web application to restrict script execution sources, which would neutralize most XSS payload classes - note this requires application-level header configuration and may break legitimate inline scripts if present. Monitor the vendor repository and VulDB entry at https://vuldb.com/vuln/386570 for patch release. If DataGear is exposed to untrusted internal users with edit access, consider temporarily disabling dashboard sharing or restricting viewer access until a fix is available.