EUVD Vulnerability Catalog

EUVD-2026-110642

Severity: HIGH Base Score: 8.3 CVSS Version: 4.0

Vulnerability Description

Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information accessible in that context.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Attack Requirements (AT): None

▪ Privileges Required (PR): Low

▪ User Interaction (UI): Active

▪ Vulnerability Confidentiality Impact (VC): High

▪ Vulnerability Integrity Impact (VI): Low

▪ Vulnerability Availability Impact (VA): Low

▪ Subsequent Confidentiality Impact (SC): High

▪ Subsequent Integrity Impact (SI): Low

▪ Subsequent Availability Impact (SA): Low

Affected Vendors & Systems

Vendor Sisense

References & Advisory Links

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sisenses-cloud-bi-platform

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

INCIBE

EPSS Probability

0.28

Known Aliases

CVE-2026-117493 GHSA-vjwh-8w5h-gwj6

Published On

2026-10-27

Last Updated

2026-11-04