Medium severity5.4NVD Advisory· Published Aug 10, 2026

CVE-2026-72743

Description

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Dataease/Sqlbotreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=1.10.0

Patches

Vulnerability mechanics

References

github.com/dataease/SQLBot/commit/c3f40a5c05a53253b2924765b02b83f6a819948fnvd
github.com/dataease/SQLBot/issues/1308nvd
github.com/dataease/SQLBot/pull/1309nvd
www.vulncheck.com/advisories/sqlbot-sqtext-dashboard-component-stored-xss-via-v-htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000