Cloud Bi Platform
Monthly
Cross-site scripting in Sisense Cloud BI Platform lets an authenticated low-privilege user submit a base64-encoded SVG data URI (data:image/svg+xml;base64) to the /api/v2/ai/sessions API, and script tags embedded in that SVG execute when the image is rendered in the AI assistant window, allowing JavaScript to run in the viewer's context and the displayed content to be altered. Successful exploitation requires the attacker to hold a valid account that can reach the sessions endpoint, and execution only occurs when a victim opens the assistant window (UI:A, PR:L per both the CVSS 4.0 vector and the independent assessment), which confines realistic abuse to account-holders or multi-tenant insiders rather than anonymous remote attackers. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; EPSS is 0.39% (33rd percentile) and the vuln.today decision label is this_week, consistent with an assessment of a genuine but second-tier priority rather than an emergency.
Stored cross-site scripting in Sisense Cloud BI Platform's BloX widgets allows an authenticated user with widget authoring privileges to place HTML and JavaScript in the 'desc' and 'text' fields via /api/dashboards/<id>/widgets/<id>; the script runs when another user renders the widget, potentially exposing data available to that victim's session. The vendor-assigned CVSS 4.0 base score is 8.3, and exploitation requires a valid low-privilege account plus victim interaction. No public exploit was identified at time of analysis; EPSS is 0.39% (33rd percentile).
Cross-site scripting in Sisense Cloud BI Platform lets an authenticated low-privilege user submit a base64-encoded SVG data URI (data:image/svg+xml;base64) to the /api/v2/ai/sessions API, and script tags embedded in that SVG execute when the image is rendered in the AI assistant window, allowing JavaScript to run in the viewer's context and the displayed content to be altered. Successful exploitation requires the attacker to hold a valid account that can reach the sessions endpoint, and execution only occurs when a victim opens the assistant window (UI:A, PR:L per both the CVSS 4.0 vector and the independent assessment), which confines realistic abuse to account-holders or multi-tenant insiders rather than anonymous remote attackers. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; EPSS is 0.39% (33rd percentile) and the vuln.today decision label is this_week, consistent with an assessment of a genuine but second-tier priority rather than an emergency.
Stored cross-site scripting in Sisense Cloud BI Platform's BloX widgets allows an authenticated user with widget authoring privileges to place HTML and JavaScript in the 'desc' and 'text' fields via /api/dashboards/<id>/widgets/<id>; the script runs when another user renders the widget, potentially exposing data available to that victim's session. The vendor-assigned CVSS 4.0 base score is 8.3, and exploitation requires a valid low-privilege account plus victim interaction. No public exploit was identified at time of analysis; EPSS is 0.39% (33rd percentile).