Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-119735— Munshi XSS via Purchase Inquiry Thread Rendering

Quick assessment

Affected

Petpooja Munshi

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

2026 年 7 月 13 日之前版本的 Munshi（由 Petpooja 开发）存在一个存储型跨站脚本（XSS）漏洞。该漏洞允许已认证用户通过“购买咨询”线程（）中提交的物品描述或消息注入恶意标记。由于在文本清洗完成之前，这些内容被直接赋值给进行渲染，攻击者可以存储恶意载荷，当其他用户打开受影响的线程时，该载荷将在其浏览器中执行，从而实现 JavaScript 代码执行和整个页面被篡改。只要该线程被重新打开，此攻击效果便会再次触发。

CVSS 5.4 · Medium EPSS 0.19% · P9 Updated Nov 03, 2026

Possible ATT&CK Techniques 2 AI

T1055.001 · Dynamic-link Library Injection T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Petpooja	Munshi	`≤ 2026-07-13`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Munshi XSS via Purchase Inquiry Thread Rendering

Source: CVE Program / CVE List V5

Vulnerability Description

Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread (/purchase-inquiry/thread/{thread-id}), which is assigned to innerHTML during rendering before text cleaning completes. Attackers can store a payload that executes in the browser of another user who opens the affected thread, achieving JavaScript execution and full-page defacement that re-triggers whenever the thread is reopened.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Petpooja	Munshi	0 ~ 2026-07-13	-

II. Public POCs for CVE-2026-119735

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119735

请登录查看更多情报信息。

Other References for CVE-2026-119735 (3)

https://www.petpooja.com/ product
https://medium.com/@TheWildEye/stored-xss-in-munshi-a-purchase-inquiry-message-could-rewrite-the-page-6b8ef14f9999 technical-description exploit
https://www.vulncheck.com/advisories/munshi-xss-via-purchase-inquiry-thread-rendering third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119735

Same Patch Batch · Petpooja · 2026-11-02 · 6 CVEs total

CVE-2026-119736	8.2 HIGH	Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials
CVE-2026-119733	8.1 HIGH	Munshi Missing Authorization in Company Deletion API
CVE-2026-119731	7.5 HIGH	Munshi Payment Bypass via Unauthenticated Webhook Endpoint
CVE-2026-119734	6.5 MEDIUM	Munshi IDOR via Purchase Inquiry Thread Endpoint
CVE-2026-119732	6.5 MEDIUM	Munshi Broken Object Level Authorization via Invoice Deletion API

IV. Related Vulnerabilities

Same product: Munshi

Same vendor: Petpooja

Same weakness: CWE-79