Is CVE-2026-109565 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109565 being exploited in the wild.

How severe is CVE-2026-109565?

Medium severity, with a CVSS score of 6.1, published 12 October 2026.

Which products and versions are affected?

Zofe Rapyd Admin 9.4.0 through 9.19.x.

Is there a fix for CVE-2026-109565?

Yes: fixed in 9.20.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109565 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-109565?

Check whether you run Zofe Rapyd Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109565: Rapyd Admin stored cross-site scripting in display names

CVE-2026-109565 · Severity: medium · CVSS 6.1 · Published 2026-10-12

Rapyd Admin is an open-source admin panel for Laravel applications. The vulnerability allows unauthenticated attackers to inject malicious scripts by registering with HTML or JavaScript code in their display names, which are then rendered unescaped in the Activity log filter that administrators use. When an admin views the Activity log and interacts with the filter, the malicious script executes in their administrative session, potentially allowing account takeover or unauthorized actions.

Technologies: Zofe Rapyd Admin. Vendors: Zofe.

Quick answers

Is CVE-2026-109565 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109565 being exploited in the wild.
How severe is CVE-2026-109565?: Medium severity, with a CVSS score of 6.1, published 12 October 2026.
Which products and versions are affected?: Zofe Rapyd Admin 9.4.0 through 9.19.x.
Is there a fix for CVE-2026-109565?: Yes: fixed in 9.20.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109565 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-109565?: Check whether you run Zofe Rapyd Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 9.20.0

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Rapyd Admin versions 9.4.0 through 9.19.x where user-supplied display names during self-registration are not properly sanitized before being rendered in the Activity log Author filter dropdown. The vulnerability is network-accessible and requires no authentication to inject the payload, but requires an authenticated administrator to view the Activity log for exploitation. An attacker can execute arbitrary JavaScript in an admin's browser session with full administrative privileges.

Affected products

zofe Rapyd Admin 9.4.0 through 9.19.x

Timeline

2026-10-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.