CVE-2026-5699: Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application

Published Oct 29, 2026

Updated

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows: parameter 'companyName' in /empresa endpoint;

Affected Software

1 affected component

SABBATIC SABBATIC application

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SABBATIC application to a version that resolves this vulnerability.
Fixed in 7.96.0.1
Upgrade
Upgrade SABBATIC application to a version that resolves this vulnerability.
Fixed in 7.96.0.2

Event History

Oct 29, 2026

CVE Published

via MITRE·11:16 AM

Data Sourced

via MITRE·11:16 AM

RemedyDescriptionWeakness

Frequently Asked Questions

What input is affected?

The affected input is the companyName parameter on the /empresa endpoint.

What access does an attacker need to exploit this issue?

An attacker needs a way to submit JavaScript code through the companyName parameter so it is stored by the application. The stored code executes when another user views the affected page.

Who is exposed to the attack?

Users who view a page containing the attacker-controlled stored companyName value are exposed, because the JavaScript runs in their browser.

CVE-2026-5699: Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application

Affected Software

Remediation

Event History

Frequently Asked Questions

What input is affected?

What access does an attacker need to exploit this issue?

Who is exposed to the attack?

Company

Resources

Contact

Frequently Asked Questions

What input is affected?

What access does an attacker need to exploit this issue?

Who is exposed to the attack?