CVE-2026-109565— Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component
Quick assessment
Affected
zofe rapyd-admin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Rapyd Admin 在 9.4.0 至 9.20.0 版本之间存在一个存储型跨站脚本（Stored XSS）漏洞，攻击者可以通过自注册的显示名称注入恶意脚本。当这些包含 HTML 或 JavaScript 的显示名称在“活动日志（Activity log）”的“作者（Author）”筛选器中未被转义地渲染时，攻击者可以在管理员会话中触发该脚本，从而执行恶意代码。
Possible ATT&CK Techniques 3 AI
T1059.001 · PowerShell T1566.002 · Spearphishing Link T1189 · Drive-by CompromiseAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| zofe | rapyd-admin | 9.4.0< 9.20.0 |
affected |
9.20.0 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109565
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component
Source: CVE Program / CVE List V5
Vulnerability Description
Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| zofe | rapyd-admin | 9.4.0 ~ 9.20.0 | - |
|
II. Public POCs for CVE-2026-109565
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109565
请登录查看更多情报信息。
Vendor Pages for CVE-2026-109565 (1)
Other References for CVE-2026-109565 (3)
Same Patch Batch · zofe · 2026-10-12 · 3 CVEs total
| CVE-2026-109566 | 9.8 CRITICAL | Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder |
| CVE-2026-109567 | 7.2 HIGH | Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component |
IV. Related Vulnerabilities
Same product: rapyd-admin
-
CVE-2026-110239
Rapyd Admin before 9.20.0 Stored XSS via rich-text Component -
CVE-2026-110238
Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via Use -
CVE-2026-109566
Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Crede -
CVE-2026-109567
Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation vi
Same vendor: zofe
-
CVE-2026-110239
Rapyd Admin before 9.20.0 Stored XSS via rich-text Component -
CVE-2026-110238
Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via Use -
CVE-2026-109566
Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Crede -
CVE-2026-109567
Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation vi
Same weakness: CWE-79
-
CVE-2026-91159
Discourse: Stored oEmbed HTML injection via allowed iframe -
CVE-2026-89069
MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages -
CVE-2026-60008
Gitea Jupyter notebook UI redress through CSS class injectio -
CVE-2026-110627
ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo -
CVE-2026-110626
ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_lang
V. Comments for CVE-2026-109565
No comments yet