{"metadata": {"vulnerability": "CVE-2026-109633", "count": 15, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-18T00:00:00Z", "date_only": false, "value": "2026-09-18T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109633", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T21:05:17.117Z", "date_only": false, "value": "2026-10-12T21:05:17.117Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-109633", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T22:22:11.618Z", "date_only": false, "value": "2026-10-12T22:22:11.618Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-109633", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T22:22:11.618Z", "date_only": false, "value": "2026-10-12T22:22:11.618Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109633", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T23:11:43.450Z", "date_only": false, "value": "2026-10-12T23:11:43.450286Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117430465529609908", "record": "CVE-2026-109633", "field": "creation_timestamp", "uuid": "c098d4ea-b89e-4d81-8961-ee588bceb0f6", "content": "CVE-2026-109633 Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109633https://github.com/frappe/erpnext/security/advisories/GHSA-rv4r-c8v3-3hrchttps://www.vulncheck.com/advisories/frappe-erpnext-before-15.119.1-stored-xss-via-public-booking-page#frappe #erpnext#CVE_2026_109633#bot", "url": "https://infosec.exchange/users/cve/statuses/117430465529609908"}, {"timestamp": "2026-10-12T23:17:28Z", "date_only": false, "value": "2026-10-12T23:17:28Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-RCFR-6R59-HM5X", "record": "GHSA-RCFR-6R59-HM5X", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T23:17:28.220Z", "date_only": false, "value": "2026-10-12T23:17:28.220", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109633", "record": "FKIE_CVE-2026-109633", "field": "published"}, {"timestamp": "2026-10-13T00:31:32Z", "date_only": false, "value": "2026-10-13T00:31:32Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RCFR-6R59-HM5X", "record": "GHSA-RCFR-6R59-HM5X", "field": "published"}, {"timestamp": "2026-10-13T00:31:32Z", "date_only": false, "value": "2026-10-13T00:31:32Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-RCFR-6R59-HM5X", "record": "GHSA-RCFR-6R59-HM5X", "field": "modified"}, {"timestamp": "2026-10-13T16:21:59.245Z", "date_only": false, "value": "2026-10-13T16:21:59.245874Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109633", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T16:21:59.245Z", "date_only": false, "value": "2026-10-13T16:21:59.245874Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109633", "record": "FKIE_CVE-2026-109633", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T16:45:24.542Z", "date_only": false, "value": "2026-10-13T16:45:24.542Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-109633", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T16:45:24.542Z", "date_only": false, "value": "2026-10-13T16:45:24.542Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109633", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T17:17:30.537Z", "date_only": false, "value": "2026-10-13T17:17:30.537", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109633", "record": "FKIE_CVE-2026-109633", "field": "lastModified"}, {"timestamp": "2026-10-14T03:50:04.981Z", "date_only": false, "value": "2026-10-14T03:50:04.981404Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxsndshgkd24", "record": "CVE-2026-109633", "field": "creation_timestamp", "uuid": "05904235-9182-4d16-8956-3af05735eb3c", "content": "CVE-2026-109633 - erpnext\nA flaw in ERPNext's public booking page stores any information entered without cleaning it. An attacker who does not need to log in can place special code that runs in the browser of\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#erpnext #frappe #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxsndshgkd24"}]}