Vulnerability Description
SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/dataease/SQLBot/commit/c3f40a5c05a53253b2924765b02b83f6a81994
- https://github.com/dataease/SQLBot/issues/1308
- https://github.com/dataease/SQLBot/pull/1309
- https://www.vulncheck.com/advisories/sqlbot-sqtext-dashboard-component-stored-xs
FAQ
What is CVE-2026-72743?
CVE-2026-72743 is a vulnerability with a CVSS score of 5.4 (MEDIUM). SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Atta...
How severe is CVE-2026-72743?
CVE-2026-72743 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-72743?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.