Live › vulnerability › CVE-2026-119735
Munshi, a restaurant management product from Petpooja, rendered user-submitted item descriptions and messages in the Purchase Inquiry thread as raw HTML before cleaning them. A logged-in user can store a script that runs in the browser of anyone who opens that thread.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 19:24 UTC. All times on this page are UTC.
Teams running Munshi by Petpooja before the 2026-07-13 release, particularly where several staff log in and use the Purchase Inquiry threads. Exposure depends on who can create content and who views the threads. The sources do not say which deployment models are affected.
No product ranges from the sources yet.
/purchase-inquiry/thread/{thread-id}).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread (/purchase-inquiry/thread/{thread-id}), which is assigned to innerHTML during rendering before text cleaning completes. Attackers can store a payload that executes in the browser of another user who opens the affected thread, achieving JavaScript execution and full-page defacement that re-triggers whenever the thread is reopened.
This page as .md · .json · in your agent: get_signal("CVE-2026-119735")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.