CVE-2026-120488
Medium · 5.4CVSS
5.4
EPSS
0.2%
Published
Nov 2, 2026
CISA due date
—
The record
LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers can save text-editor, HTML, text or heading blocks containing script or event-handler markup that executes in administrator or Superadmin sessions viewing the builder, preview or page.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-115541 HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in… CWE-79
- CVE-2026-82160 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper… CWE-79
- CVE-2026-82161 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper… CWE-79
- CVE-2026-82158 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper… CWE-79
- CVE-2026-82159 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper… CWE-79
- CVE-2025-71451 Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting… CWE-79
- CVE-2025-71452 Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting… CWE-79
- CVE-2026-63197 traQ is a messenger application built for Digital Creators Club traP. CWE-79