Live › vulnerability › CVE-2026-117493
Go to dashboardStored XSS in the BloX widgets of Sisense Cloud BI Platform (SaaS). The /api/dashboards/*/widgets/* API stores HTML and JavaScript sent in the desc and text parameters. The script runs in the browser of any user who views the widget. Reported by INCIBE (CVSS v4 8.3). No fix has been reported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 10:31 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Cloud BI Platform | vendor | unknown (NVD: all before 27/10/2026) | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information accessible in that context.
This page as .md · .json · in your agent: get_signal("CVE-2026-117493")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.