Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
CVE-2026-59667: Repasat application lets attackers run code in users' browsers
CVE-2026-59667 · published 1 month ago
Summary
The Repasat web application accepts a value called “nomTamano” without proper checks. An attacker can craft a link that causes a user’s browser to run unwanted code, potentially exposing personal or business data. Apply the latest security update from the vendor and ensure input validation is in place.
What to do
- Update repasat repasat application to version Abril patch "20260402" or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| repasat | repasat application | < Abril patch "20260402" |
Original advisory text
Multiple vulnerabilities in the Repasat application
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizemployees/update”.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
4.8
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published2 Oct 2026
Updated3 Nov 2026
First seen2 Oct 2026
Track software like this
Free during beta