CVE-2026-110239

EUVD-2026-99023
Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.4 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 13.44%
Common Weakness Enumeration
References
https://github.com/zofe/rapyd-admin
https://github.com/zofe/rapyd-admin/blob/v9.19.0/resources/views/components/rich-text.blade.php#L50-L61
https://github.com/zofe/rapyd-admin/blob/v9.19.0/src/helpers.php#L11-L29
https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a
https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0
https://www.vulncheck.com/advisories/rapyd-admin-before-9.20.0-stored-xss-via-rich-text-component