SQLView KRIS EUVD-2026-94804

Exploitation requires that the attacker already possess administrative access to SQLView KRIS and use the Workflow Template feature to store a malicious payload in the 'template name' field, which the application renders without server-side sanitisation into an onclick attribute on the main dashboard. Execution additionally requires victim user interaction - a separate user must load the main dashboard and trigger the affected element - consistent with UI:R. The principal limiting factors are therefore the administrative privilege prerequisite (PR:H), which confines the attack to malicious or compromised admins, and the dependency on victim interaction with the dashboard; it is not a remote-unauthenticated issue.

This is a stored cross-site scripting (XSS) / code-injection flaw in SQLView KRIS's Workflow Template feature, rated CVSS 6.8 (Medium) in the input. The provided vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H is internally tense: PR:H and UI:R are consistent with the description (an attacker must already hold administrative access to store the payload, and a victim must subsequently load the dashboard), but the C:H/I:H/A:H impact rating is unusually high for a browser-executed stored XSS and appears inflated - XSS typically yields limited confidentiality/integrity impact in the victim's session rather than full system compromise. No EPSS score, CISA KEV listing, SSVC decision data, or proof-of-concept is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The dominant mitigating signal is PR:H: the attacker must already be an administrator, which both narrows the realistic threat to insider/compromised-admin scenarios and substantially lowers real-world urgency. Net assessment: a legitimate but lower-priority medium-severity issue - the high base impact metrics overstate real risk given the admin precondition and absence of any exploitation signal. Verify the true impact scope and affected versions with the CSA advisory / SQLView vendor, as CWE is marked N/A and no version data is provided.

An attacker who already holds administrative access to SQLView KRIS creates or edits a Workflow Template and embeds a malicious script into the 'template name' field; because the value is rendered unsanitised inside an onclick attribute on the main dashboard, the payload is stored. When another user (e.g., another administrator or operator) later loads the dashboard and interacts with the affected element, the script executes in their browser, enabling session/credential theft or actions in their authenticated context. No public proof-of-concept is identified in the provided data.