CVE-2026-89191 — Stored Cross-Site Scripting in SQLView KRIS

CVE-2026-89191

Stored Cross-Site Scripting in SQLView KRIS PUBLISHED

Description (CNA)

Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation, allowing an attacker with administrative access to inject and store malicious scripts that execute in the browsers of affected users.

Affected (CNA)

Vendor / product	Versions
SQLView / SQLView KRIS	affected 4.6.4.4 and below

CWE

No CWE identifiers supplied.

References

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-136/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.