Stored Cross-Site Scripting in Munshi by Petpooja

CVE-2026-119735

What is CVE-2026-119735?

Munshi, a product by Petpooja, was found to have a stored cross-site scripting vulnerability that enables authenticated users to inject malicious scripts via item descriptions or messages submitted in the Purchase Inquiry thread. This vulnerability occurs because user inputs that are rendered with innerHTML are not properly sanitized, allowing attackers to store payloads that execute in the browsers of unsuspecting users who access the affected thread. Consequently, this can lead to unauthorized JavaScript execution and can deface the entire page whenever the thread is reopened.

References