Stored Cross-Site Scripting Vulnerability in Rapyd Admin

CVE-2026-109565

What is CVE-2026-109565?

A stored cross-site scripting vulnerability in Rapyd Admin versions earlier than 9.20.0 allows attackers to inject malicious scripts through self-registered display names. By exploiting this flaw, an attacker can register with a display name containing HTML or JavaScript code, which is rendered unescaped in the Activity log Author filter. This injection can lead to the execution of scripts in the context of an administrator's session, potentially compromising sensitive data or application integrity.

References