CVE-2026-79419
Received Received - Intake

Reflected XSS in EMX Tecnologia Gestao X Business Suite

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: MITRE

Description
A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an unauthenticated attacker to inject arbitrary JavaScript code that is reflected and executed in the context of a victim's browser.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-79419
EUVD
EUVD-2026-71456

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
emx_tecnologia gestao_x_business_suite to 8.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. It occurs due to insufficient validation and sanitization of the 'mensagem' parameter in the /Configuracao/Imagens.aspx endpoint. An unauthenticated attacker can inject malicious JavaScript code that is reflected back and executed in a victim's browser.

Detection Guidance

To detect this reflected XSS vulnerability, inspect HTTP requests and responses to the /Configuracao/Imagens.aspx endpoint for unsanitized user input in the mensagem parameter. Use tools like curl to send test payloads containing JavaScript snippets and check if they are reflected without proper encoding.

Impact Analysis

An attacker could exploit this to steal session cookies, perform actions on behalf of the user, or redirect users to malicious websites. It may lead to unauthorized data access, account takeover, or defacement of web pages.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to personal data or HIPAA by exposing protected health information. It may lead to non-compliance due to insufficient security controls for protecting user data.

Mitigation Strategies

Immediately apply input validation and output encoding to the mensagem parameter in the /Configuracao/Imagens.aspx endpoint. Ensure all user-supplied data is sanitized before rendering in the browser. Update to the latest version of Gestao X Business Suite if a patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79419. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart