CVE-2026-72743

MEDIUM 5.4

SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.

CWE	CWE-79
Vendor	dataease
Product	sqlbot
Published	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for dataease sqlbot

Be the first to know when new medium vulnerabilities affecting dataease sqlbot are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

dataease / SQLBot

0 ≤ 1.10.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/dataease/SQLBot/issues/1308 github.com: https://github.com/dataease/SQLBot/pull/1309 github.com: https://github.com/dataease/SQLBot/commit/c3f40a5c05a53253b2924765b02b83f6a819948f vulncheck.com: https://www.vulncheck.com/advisories/sqlbot-sqtext-dashboard-component-stored-xss-via-v-html

Credits

YU SUN