CVE-2026-59669
MediumCVSS 4.8Summary
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The "name" parameter is affected – endpoint "/es/attachmenttypes/update/203336".
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session or data theft, or performing actions on behalf of the user. This may compromise the security of application data and user accounts.
Recommendation
Update the Repasat application to a version containing the fix for this parameter. Implement input and output validation and encoding to prevent XSS.
Other vulnerabilities in Repasat
See all- CVE-2026-59668Medium
The Repasat application is vulnerable to Cross-Site Scripting (XSS) via the 'nomTamano' parameter in the '/es/companysizebills/store' endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser.
- CVE-2026-59667Medium
The Repasat application is vulnerable to Cross-Site Scripting (XSS) via the 'nomTamano' parameter in the '/es/companysizemployees/update' endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser.
- CVE-2026-59666Medium
The Repasat application is vulnerable to Cross-Site Scripting (XSS) via the 'nomOrigen' parameter in the '/es/origins/store' endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser.
- CVE-2026-95662Medium
The Repasat application has a Cross-Site Scripting vulnerability in the nomCompetidor parameter at the /es/competitors/store endpoint. An attacker can trick a user into executing arbitrary code in the browser.
- CVE-2026-59673Medium
The Repasat application has a Cross-Site Scripting vulnerability in the nomTipoCli parameter at the /es/clientypes/update/109441 endpoint. An attacker can trick a user into executing arbitrary code in the browser.
- CVE-2026-59672Medium
The Repasat application has a Cross-Site Scripting vulnerability in the nomGrupoEmpresarial parameter at the /es/corporategroups/update/246 endpoint. An attacker can trick a user into executing arbitrary code in the browser.
- CVE-2026-59665Medium
The Repasat application has a Cross-Site Scripting vulnerability in the nomMotivo parameter at the /es/lostmotives/store endpoint. An attacker can trick a user into executing arbitrary code in the browser.
- CVE-2026-59664Medium
The Repasat application has a Cross-Site Scripting vulnerability in the nomServicioPrestado parameter at the /es/providedservices/store endpoint. An attacker can trick a user into executing arbitrary code in the browser.
- CVE-2026-59663Medium
Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomDelegacion' at endpoint '/es/delegations/store'.
- CVE-2026-59662Medium
Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomCompetidor' at endpoint '/es/competitors/store'.
Original NVD description (English source)
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “name” parameter is affected – endpoint “/es/attachmenttypes/update/203336”
Vulnerability data from NVD (NIST) · CISA KEV · EPSS