Is there a public PoC exploit available for CVE-2026-72743?

Yes, a public proof-of-concept exploit is available for CVE-2026-72743. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-72743?

Yes, a patch is available for CVE-2026-72743. Update the affected software to the latest version immediately.

SQLBot CVE-2026-72743

Q: What is the CVSS score of CVE-2026-72743?

CVE-2026-72743 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-55801 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-10 VulnCheck

GHSA-vm6h-rfrh-ph3m

XSS Dataease Sqlbot

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Stored XSS requires low-privilege dashboard edit access (PR:L), triggers on victim page view (UI:R), and affects other users' browser sessions via scope change (S:C); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 10, 2026 - 20:45 vuln.today

Analysis Generated

Aug 10, 2026 - 20:45 vuln.today

CVE Published

Aug 10, 2026 - 20:06 cve.org

MEDIUM 5.1

DescriptionCVE.org

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.

AnalysisAI

Stored cross-site scripting in SQLBot's SQText dashboard component allows any authenticated low-privilege user who can edit dashboard widgets to inject persistent HTML and JavaScript that executes in the browser of every user who views the affected dashboard. All versions through 1.10.0 are affected per CPE data (cpe:2.3:a:dataease:sqlbot:*:*:*:*:*:*:*:*), with the root cause confirmed by source code evidence as Vue's v-html directive rendering unsanitized TinyMCE output. No public exploit identified at time of analysis via active exploitation (CISA KEV), though publicly available exploit code exists via GitHub issue #1308, and a vendor-released patch is available as of commit c3f40a5.

Technical ContextAI

SQLBot is a Vue.js-based SQL analytics and dashboard product by dataease. The vulnerable component is the SQText text widget in the dashboard frontend (frontend/src/views/dashboard/components/sq-text/index.vue). The widget uses TinyMCE as a rich-text editor and binds its output to the DOM using Vue's v-html directive, which renders raw HTML without any sanitization. This directly maps to CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant: attacker-controlled content is persisted server-side and replayed to all subsequent dashboard viewers. The fix confirmed in PR #1309 replaces v-html with v-dompurify-html, applying DOMPurify client-side sanitization before DOM insertion. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms network delivery with no special attack conditions and passive victim interaction.

RemediationAI

Vendor-released patch: commit c3f40a5 (upstream fix available via PR/commit; released patched version not independently confirmed beyond the commit). Upgrade by pulling from commit c3f40a5c05a53253b2924765b02b83f6a819948f or later from https://github.com/dataease/SQLBot/commit/c3f40a5c05a53253b2924765b02b83f6a819948f. For deployments unable to patch immediately, the most effective compensating control is restricting dashboard widget edit permissions to fully trusted users only - reducing the attacker population to administrators eliminates the low-privilege exploitation path, though it limits collaborative dashboard authoring. Blocking or disabling the SQText widget type entirely removes the attack surface at the cost of losing rich-text dashboard functionality. Do not rely on input filtering at the TinyMCE editor layer alone, as the underlying issue is client-side rendering without DOMPurify sanitization.