CVE-2026-59666
MediumCVSS 4.8Summary
The Repasat application is vulnerable to Cross-Site Scripting (XSS) via the 'nomOrigen' parameter in the '/es/origins/store' endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser.
Risk Assessment
An attacker can execute arbitrary JavaScript in a victim's browser, potentially leading to session data theft, redirects, or other attacks. The risk is high as it only requires tricking a user into interacting with a malicious link.
Recommendation
Update the Repasat application to a version that fixes this vulnerability, or implement proper input filtering and escaping for the 'nomOrigen' parameter. Consider deploying CSP headers to mitigate XSS impact.
Other vulnerabilities in Repasat
See all- CVE-2026-59668Medium
The Repasat application is vulnerable to Cross-Site Scripting (XSS) via the 'nomTamano' parameter in the '/es/companysizebills/store' endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser.
- CVE-2026-59667Medium
The Repasat application is vulnerable to Cross-Site Scripting (XSS) via the 'nomTamano' parameter in the '/es/companysizemployees/update' endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser.
- CVE-2026-95662Medium
The Repasat application has a Cross-Site Scripting vulnerability in the nomCompetidor parameter at the /es/competitors/store endpoint. An attacker can trick a user into executing arbitrary code in the browser.
- CVE-2026-59673Medium
The Repasat application has a Cross-Site Scripting vulnerability in the nomTipoCli parameter at the /es/clientypes/update/109441 endpoint. An attacker can trick a user into executing arbitrary code in the browser.
- CVE-2026-59672Medium
The Repasat application has a Cross-Site Scripting vulnerability in the nomGrupoEmpresarial parameter at the /es/corporategroups/update/246 endpoint. An attacker can trick a user into executing arbitrary code in the browser.
- CVE-2026-59665Medium
The Repasat application has a Cross-Site Scripting vulnerability in the nomMotivo parameter at the /es/lostmotives/store endpoint. An attacker can trick a user into executing arbitrary code in the browser.
- CVE-2026-59664Medium
The Repasat application has a Cross-Site Scripting vulnerability in the nomServicioPrestado parameter at the /es/providedservices/store endpoint. An attacker can trick a user into executing arbitrary code in the browser.
- CVE-2026-59663Medium
Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomDelegacion' at endpoint '/es/delegations/store'.
- CVE-2026-59662Medium
Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomCompetidor' at endpoint '/es/competitors/store'.
- CVE-2026-59661Medium
Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomRuta' at endpoint '/es/routes/update/693'.
Original NVD description (English source)
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomOrigen” parameter is affected – endpoint “/es/origins/store”.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS