# CVE-2026-119735: Munshi stored cross-site scripting in purchase inquiry thread

Source: https://junglewise.ai/threats/cve-2026-119735-munshi-by-petpooja-before-2026-07-13-contained-a-stored-cross  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-119735 · Severity: medium · CVSS 5.4 · Published 2026-11-02

Munshi, a business management software by Petpooja used by SMEs for restaurant operations and procurement, contains a stored cross-site scripting (XSS) vulnerability in its purchase inquiry feature. An authenticated attacker can inject malicious code through item descriptions or thread messages that executes in other users' browsers when they view the affected thread, leading to full-page defacement, data theft, or session hijacking.

Technologies: [Petpooja Munshi](https://junglewise.ai/threats/technologies/munshi). Vendors: [Petpooja](https://junglewise.ai/threats/vendors/petpooja).

## Quick answers

**Is CVE-2026-119735 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119735 being exploited in the wild.

**How severe is CVE-2026-119735?** Medium severity, with a CVSS score of 5.4, published 2 November 2026.

**Which products and versions are affected?** Petpooja Munshi before 2026-07-13.

**Is there a fix for CVE-2026-119735?** Yes: fixed in Munshi 2026-07-13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119735 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-119735?** Check whether you run Petpooja Munshi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Munshi 2026-07-13 or later

## Technical details

The vulnerability is a stored XSS flaw in the /purchase-inquiry/thread/{thread-id} endpoint where user-supplied input in item descriptions and messages is assigned to innerHTML before sanitization is complete. An authenticated attacker can craft a malicious payload that persists in the database and executes in the JavaScript context of any user who opens the affected thread, achieving arbitrary script execution in their browser session.

## Affected products

- Petpooja Munshi before 2026-07-13

## Timeline

- 2026-11-02: disclosed

## References

- [https://medium.com/@TheWildEye/stored-xss-in-munshi-a-purchase-inquiry-message-could-rewrite-the-page-6b8ef14f9999](https://medium.com/@TheWildEye/stored-xss-in-munshi-a-purchase-inquiry-message-could-rewrite-the-page-6b8ef14f9999)
- [https://www.petpooja.com/](https://www.petpooja.com/)

## Related threats

- [Petpooja Munshi broken object level authorization](https://junglewise.ai/threats/cve-2026-119734-munshi-by-petpooja-before-2026-06-17-contained-a-broken-object)
- [Munshi authorization bypass in company deletion](https://junglewise.ai/threats/cve-2026-119733-munshi-by-petpooja-before-2026-07-07-contained-a-missing)
- [Petpooja Munshi broken object level authorization in invoice endpoints](https://junglewise.ai/threats/cve-2026-119732-munshi-by-petpooja-before-2026-07-28-contained-a-broken-object)
- [Petpooja Munshi payment bypass in webhook](https://junglewise.ai/threats/cve-2026-119731-munshi-by-petpooja-before-2026-06-30-contained-a-payment-bypass)