CVE-2026-59663
MediumCVSS 4.8Summary
Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomDelegacion' at endpoint '/es/delegations/store'.
Risk Assessment
The risk to the organization includes potential session theft, account takeover, or malware distribution within employee browsers.
Recommendation
Apply vendor patches immediately and implement input validation and sanitization for the 'nomDelegacion' parameter.
Other vulnerabilities in Repasat
See all- CVE-2026-59668Medium
The Repasat application is vulnerable to Cross-Site Scripting (XSS) via the 'nomTamano' parameter in the '/es/companysizebills/store' endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser.
- CVE-2026-59667Medium
The Repasat application is vulnerable to Cross-Site Scripting (XSS) via the 'nomTamano' parameter in the '/es/companysizemployees/update' endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser.
- CVE-2026-59666Medium
The Repasat application is vulnerable to Cross-Site Scripting (XSS) via the 'nomOrigen' parameter in the '/es/origins/store' endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser.
- CVE-2026-95662Medium
The Repasat application has a Cross-Site Scripting vulnerability in the nomCompetidor parameter at the /es/competitors/store endpoint. An attacker can trick a user into executing arbitrary code in the browser.
- CVE-2026-59673Medium
The Repasat application has a Cross-Site Scripting vulnerability in the nomTipoCli parameter at the /es/clientypes/update/109441 endpoint. An attacker can trick a user into executing arbitrary code in the browser.
- CVE-2026-59672Medium
The Repasat application has a Cross-Site Scripting vulnerability in the nomGrupoEmpresarial parameter at the /es/corporategroups/update/246 endpoint. An attacker can trick a user into executing arbitrary code in the browser.
- CVE-2026-59665Medium
The Repasat application has a Cross-Site Scripting vulnerability in the nomMotivo parameter at the /es/lostmotives/store endpoint. An attacker can trick a user into executing arbitrary code in the browser.
- CVE-2026-59664Medium
The Repasat application has a Cross-Site Scripting vulnerability in the nomServicioPrestado parameter at the /es/providedservices/store endpoint. An attacker can trick a user into executing arbitrary code in the browser.
- CVE-2026-59662Medium
Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomCompetidor' at endpoint '/es/competitors/store'.
- CVE-2026-59661Medium
Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomRuta' at endpoint '/es/routes/update/693'.
Original NVD description (English source)
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomDelegacion” parameter is affected – endpoint “/es/delegations/store”.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS