CVE-2026-79419

Deferred Deferred - Pending Action

Reflected XSS in EMX Tecnologia Gestao X Business Suite

Publication date: 2026-09-04

Last updated on: 2026-09-09

Assigner: MITRE

Description

A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to inject arbitrary JavaScript code that is reflected and executed in the context of a victim's browser.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-09

Generated

2026-09-25

AI Q&A

2026-09-04

EPSS Evaluated

2026-09-23

NVD

CVE-2026-79419

EUVD

EUVD-2026-71456

Affected Vendors & Products

Vendor	Product	Version / Range
emx_tecnologia	gestao_x_business_suite	to 8.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. It occurs due to insufficient validation and sanitization of the 'mensagem' parameter in the /Configuracao/Imagens.aspx endpoint. An unauthenticated attacker can inject malicious JavaScript code that is reflected back and executed in a victim's browser.

Detection Guidance

To detect this reflected XSS vulnerability, inspect HTTP requests and responses to the /Configuracao/Imagens.aspx endpoint for unsanitized user input in the mensagem parameter. Use tools like curl to send test payloads containing JavaScript snippets and check if they are reflected without proper encoding.

Impact Analysis

An attacker could exploit this to steal session cookies, perform actions on behalf of the user, or redirect users to malicious websites. It may lead to unauthorized data access, account takeover, or defacement of web pages.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to personal data or HIPAA by exposing protected health information. It may lead to non-compliance due to insufficient security controls for protecting user data.

Mitigation Strategies

Immediately apply input validation and output encoding to the mensagem parameter in the /Configuracao/Imagens.aspx endpoint. Ensure all user-supplied data is sanitized before rendering in the browser. Update to the latest version of Gestao X Business Suite if a patch is available.

Hi! I’m here to help you understand CVE-2026-79419. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70