Published: October 12, 2026 | Last Modified: October 12, 2026
Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.
This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.