CVE-2026-124637: Stored Cross-Site Scripting (XSS) in Tankuam Places

Published Nov 9, 2026

Updated

A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a request to https://www.luxorgymtarrega.com/dadespersonals/modificarClient/ID. User-provided data is neither validated nor escaped before being displayed in the HTML response and stored in the database, allowing arbitrary JavaScript code to be executed in the victim’s browser.

Affected Software

1 affected component

Tankuam Places

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Tankuam Places to a version that resolves this vulnerability.
Fixed in apl.00007.00005

Event History

Nov 9, 2026

CVE Published

via MITRE·09:15 AM

Data Sourced

via MITRE·09:15 AM

RemedyDescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must be able to submit crafted input through the profile editing form, specifically using the cliNom or cliCognoms parameters in requests to the modificarClient endpoint. The available information does not state whether authentication is required.

Who is exposed to the injected script?

Any victim whose browser displays the stored profile data can have arbitrary JavaScript executed in their browser. The malicious input is stored in the database and later rendered in an HTML response without validation or escaping.

CVE-2026-124637: Stored Cross-Site Scripting (XSS) in Tankuam Places

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Who is exposed to the injected script?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Who is exposed to the injected script?