CVE-2026-110239

Rapyd Admin before 9.20.0 Stored XSS via rich-text Component

State: Published
Severity: 2.1 Low
Published: Oct 13, 2026
Updated: Oct 14, 2026
Reserved: Oct 13, 2026

Description

Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.

Scores

CVSS	Score	Vector	Source
4.0	2.1 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	VulnCheck
3.1	4.4 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
rapyd-adminzofe	0.4.0Affected 0.8.5 through 0.12.17Affected 1.0.0Affected 1.1.0 through 1.1.8Affected 9.0.0 to before 9.20.0Affected 9.20.0Not affected

References

Patch Commitpatch
rapyd-admin v9.20.0 Release Notesrelease-notes
Vulnerable code in rich-text.blade.phptechnical-description
dot_to_property helper in helpers.phptechnical-description
https://github.com/zofe/rapyd-adminproduct
VulnCheck Advisory: Rapyd Admin before 9.20.0 Stored XSS via rich-text Componentthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.