HIGHCVSS v4 8.3Vulnerability
CVE-2026-117493
Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information accessible in that context.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-10-27T11:29:09.292804+00:00
- Cvss severity
- HIGH
- Cvss score
- 8.3
- Retrieved at
- 2026-10-27T11:30:36+00:00
- Score
- 8.3
- Cvss version
- 4.0
- Last source
- NVD
- Cve id
- CVE-2026-117493
- Cvss vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- First seen by Signal
- 2026-10-27T11:30:36+00:00
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Published at
- 2026-10-27T10:16:54.420
- Last modified
- 2026-10-27T10:16:54.420
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph