Vulnerability record/PUBLISHED/Published Oct 27, 2026 09:15:40 UTC

CVE-2026-117493

Stored Cross-Site Scripting (XSS) in Sisense BloX widgets, in all versions, both on Sisense Cloud and in self-hosted deployments, allows an authenticated user with the Designer or Administrator role to execute JavaScript code in the browser of another user who opens the dashboard, via HTML or JavaScript code inserted into BloX widget fields, such as ‘desc’ and ‘text’.

Base score8.3/ 10

SeverityHighCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityHigh

Attack vectorNetworkAV

Attack complexityLowAC

Attack requirementsNoneAT

Privileges requiredLowPR

User interactionActiveUI

Vulnerable system confidentialityHighVC

Vulnerable system integrityLowVI

Vulnerable system availabilityLowVA

Subsequent system confidentialityHighSC

Subsequent system integrityLowSI

Subsequent system availabilityLowSA

CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityINCIBE

Last updatedNov 6, 2026 13:46:09 UTC

PublishedOct 27, 2026 09:15:40 UTC

ReservedOct 27, 2026 08:25:36 UTC

Credits

Miguel Jiménez Cámara