CVE-2026-19110

Name of the Vulnerable Software and Affected Versions DataGear versions prior to 5.0.0

Description Cross site scripting occurs in the Chart Name Handler component due to improper handling of the Title argument within the HtmlTplDashboardWidgetHtmlRenderer() function of the HtmlTplDashboardWidgetHtmlRenderer.java file. This issue allows a remote attacker to execute malicious scripts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the HtmlTplDashboardWidgetHtmlRenderer() function to minimize the risk of exploitation.