Threat database

CVE-2026-110239 is a stored cross-site scripting (XSS) vulnerability in zofe rapyd-admin versions before 9.20.0. The issue occurs in the x-rpd::rich-text Blade component, which outputs bound model values as raw HTML without sanitization. Authenticated users can exploit this by injecting JavaScript via the Livewire client API, which executes when administrators open the affected record's form. The vulnerability has a low CVSS score of 2.1 and requires authentication with low privileges to exploit.

Rapyd Admin versions from 9.0.0 up to but not including 9.20.0 contain an authorization bypass vulnerability. Authenticated users with the default customer role can exploit this flaw via the UsersModalEditEmbed Livewire component to modify or delete arbitrary user accounts. This includes resetting passwords of owners or super admins, promoting themselves to owner, and deleting users.

CVE-2026-109567 is an improper privilege management vulnerability in zofe rapyd-admin versions 9.0.0 up to but not including 9.20.0. It affects the UsersEdit Livewire component, allowing users with the edit users permission to assign themselves the admin role. This enables privilege escalation by bypassing tenant scoping and per-record authorization, potentially allowing impersonation of other users.

Rapyd Admin versions 9.0.0 up to but not including 9.20.0 contain a hard-coded credentials vulnerability. An admin account with fixed credentials (admin@laravel / 'admin') is created during setup and can be recreated by certain commands. This allows remote unauthenticated attackers to gain super-admin access, bypassing authorization and tenant scoping controls.

Rapyd Admin versions from 9.4.0 up to but not including 9.20.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts via self-registered display names. The injected scripts are rendered unescaped in the Activity log Author filter, potentially executing in an administrator's session. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.