Sqlview Kris
Monthly
Stored cross-site scripting (XSS) in the Workflow Template feature of SQLView KRIS lets an actor who already holds administrative access store a script payload in the 'template name' field, which the application renders into an onclick attribute on the main dashboard without server-side sanitisation; the script then executes in the browser of any user who loads that dashboard and triggers the affected element. Per the CVSS vector (AV:N/AC:L/PR:H/UI:R), exploitation requires high administrative privileges and a separate victim's interaction, so the practical exposure is confined to malicious or compromised administrators rather than unauthenticated outsiders, and the independent assessment rates the resulting confidentiality and integrity impact as Low with no availability impact (CVSS 6.8, Medium). There is no KEV entry and no public exploit code identified at time of analysis.
Stored cross-site scripting (XSS) in the Workflow Template feature of SQLView KRIS lets an actor who already holds administrative access store a script payload in the 'template name' field, which the application renders into an onclick attribute on the main dashboard without server-side sanitisation; the script then executes in the browser of any user who loads that dashboard and triggers the affected element. Per the CVSS vector (AV:N/AC:L/PR:H/UI:R), exploitation requires high administrative privileges and a separate victim's interaction, so the practical exposure is confined to malicious or compromised administrators rather than unauthenticated outsiders, and the independent assessment rates the resulting confidentiality and integrity impact as Low with no availability impact (CVSS 6.8, Medium). There is no KEV entry and no public exploit code identified at time of analysis.