Description
Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information accessible in that context.
Published: 2026-10-27
Score: 8.3 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

No solution has been reported as yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Description Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information accessible in that context.
Title Multiple vulnerabilities in Sisense’s Cloud BI Platform
First Time appeared Cloud Bi Platform
Cloud Bi Platform sisense
Weaknesses CWE-79
CPEs cpe:2.3:a:cloud_bi_platform:sisense:*:*:*:*:*:*:*:*
Vendors & Products Cloud Bi Platform
Cloud Bi Platform sisense
References
Metrics cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L'}

Subscriptions

Cloud Bi Platform Sisense
cve-icon MITRE

Status: PUBLISHED

Assigner: INCIBE

Published:

Updated: 2026-10-27T09:17:28.701Z

Reserved: 2026-10-27T08:25:36.708Z

Link: CVE-2026-117493

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-27T10:16:54.420

Modified: 2026-10-27T15:02:47.683

Link: CVE-2026-117493

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T11:00:15Z

Weaknesses