Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.8

Repasat application lets attackers run code in users' browsers

CVE-2026-59664 · published 1 month ago
Summary

The Repasat web app has a flaw that lets a malicious link cause a user’s browser to run unexpected code when they visit a specific page. This could let an attacker steal information or perform actions as the user. Apply the vendor’s security update or disable the affected page until it is patched.

What to do
  • Update repasat repasat application to version Abril patch "20260402" or later.
Affected software
VendorProductAffected versions
repasat repasat application < Abril patch "20260402"
Original advisory text
Multiple vulnerabilities in the Repasat application
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomServicioPrestado” parameter is affected – endpoint “/es/providedservices/store”.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published2 Oct 2026
Updated4 Nov 2026
First seen2 Oct 2026
Sources
CVE-2026-59664 · NVD
CVE-2026-59664 · MITRE
Track software like this
Free during beta