Medium 5.4Published Aug 10, 2026

CVE-2026-72743SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html

Updated under an hour ago (2026-10-19 07:23 UTC)

Does this affect you?

It affects dataease SQLBot. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for dataease SQLBot

Exploited in the last 30 days

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.

CVSS: 5.4 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

dataease SQLBot dataease:sqlbot (from the name)	through 1.10.0; c3f40a5c05a53253b2924765b02b83f6a819948f not affected	CNA record

References

https://github.com/dataease/SQLBot/issues/1308technical-description, exploit
https://github.com/dataease/SQLBot/pull/1309issue-tracking
https://github.com/dataease/SQLBot/commit/c3f40a5c05a53253b2924765b02b83f6a819948fpatch
https://www.vulncheck.com/advisories/sqlbot-sqtext-dashboard-component-stored-xss-via-v-htmlthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.