CVE-2026-89191 Details
Description
Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation, allowing an attacker with administrative access to inject and store malicious scripts that execute in the browsers of affected users.
A stored cross-site scripting vulnerability has been identified in SQLView KRIS, specifically in the Workflow Template feature. This issue arises from unsanitized input in the 'template name' field, which is displayed in 'onclick' attributes on the main dashboard without adequate server-side sanitization. As a result, an attacker with administrative access can inject and save malicious scripts that execute in the browsers of affected users. The vulnerability impacts SQLView KRIS versions through 4.6.4.4.
SQLView has released a patch for this vulnerability. Users and administrators are advised to update to the latest version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-136/ | CSA | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| SQLView KRIS | <= 4.6.4.4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | CSA |