CVE-2026-89191: Vulnerability in SQLView SQLView KRIS

The vulnerability arises from improper server-side sanitisation of the "template name" field in SQLView KRIS's Workflow Template feature. Specifically, unsanitised input is rendered within "onclick" attributes on the main dashboard, enabling stored cross-site scripting (XSS) attacks. An attacker with administrative privileges can inject malicious scripts that execute in the context of other users' browsers when they view the dashboard.

Successful exploitation allows an attacker with administrative access to execute arbitrary scripts in the browsers of users viewing the affected dashboard. This can lead to compromise of user sessions, data theft, or other malicious actions within the context of the affected application. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and consider additional input validation or sanitisation controls if possible.