CVE-2026-119735
Medium · 5.4CVSS
5.4
EPSS
0.2%
Published
Nov 2, 2026
CISA due date
—
The record
Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread (/purchase-inquiry/thread/{thread-id}), which is assigned to innerHTML during rendering before text cleaning completes. Attackers can store a payload that executes in the browser of another user who opens the affected thread, achieving JavaScript execution and full-page defacement that re-triggers whenever the thread is reopened.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-115541 HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in… CWE-79
- CVE-2026-82160 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper… CWE-79
- CVE-2026-82161 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper… CWE-79
- CVE-2026-82158 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper… CWE-79
- CVE-2026-82159 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper… CWE-79
- CVE-2025-71451 Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting… CWE-79
- CVE-2025-71452 Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting… CWE-79
- CVE-2026-63197 traQ is a messenger application built for Digital Creators Club traP. CWE-79