CVE-2026-59669
Received Received - Intake

Cross-Site Scripting in Repasat Application

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “name” parameter is affected – endpoint “/es/attachmenttypes/update/203336”

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-59669
EUVD
EUVD-2026-91319

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in the Repasat application. It allows an attacker to inject malicious scripts via the 'name' parameter in the '/es/attachmenttypes/update/203336' endpoint. When exploited, it can trick users into executing arbitrary code in their browsers.

Detection Guidance

To detect this XSS vulnerability, inspect web traffic for requests to the /es/attachmenttypes/update/203336 endpoint with a malformed 'name' parameter. Check for unusual script tags or payloads in input fields. Use tools like Burp Suite or OWASP ZAP to monitor HTTP requests for suspicious inputs.

Impact Analysis

An attacker could exploit this to steal user sessions, redirect to malicious sites, or perform actions on behalf of the user. It requires user interaction and low privileges, making it easier to exploit but limited in impact.

Compliance Impact

XSS vulnerabilities can lead to data breaches, which may violate GDPR (data protection) and HIPAA (health data privacy). Compliance could be impacted if user data is compromised due to this flaw.

Mitigation Strategies

Update Repasat to the patched version '20260402' immediately. Implement input validation and output encoding for the 'name' parameter. Use Content Security Policy (CSP) headers to mitigate XSS risks. Monitor for unusual activity in web logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59669. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart