CVE-2026-109565: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in zofe rapyd-admin

Rapyd Admin versions from 9.4.0 before 9.20.0 contain a stored cross-site scripting vulnerability. Unauthenticated attackers can register accounts with display names containing HTML or JavaScript code. This code is not properly neutralized and is rendered unescaped in the Activity log Author filter, leading to script execution in the context of an administrator's session.

An attacker can execute arbitrary scripts in the administrator's browser session by injecting malicious code through self-registered display names. This can lead to session hijacking or other actions performed with administrator privileges. However, the attack requires the attacker to register an account and relies on the administrator viewing the affected filter, limiting the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when reviewing Activity log Author filters and consider restricting or monitoring self-registered user display names for suspicious content.