CVE-2026-59664: Multiple vulnerabilities in the Repasat application

Published Oct 2, 2026

Updated

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomServicioPrestado” parameter is affected – endpoint “/es/providedservices/store”.

Affected Software

1 affected component

Repasat Repasat

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Repasat application to a version that resolves this vulnerability.
Fixed in 20260402

Event History

Oct 2, 2026

CVE Published

via MITRE·10:02 AM

Data Sourced

via MITRE·10:02 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The CVSS vector indicates low privileges are required. Exploitation also requires user interaction, meaning an attacker would need to trick a victim into interacting with malicious content.

Which functionality should be prioritized for review?

Review the /es/providedservices/store endpoint and its nomServicioPrestado parameter. The issue is an XSS vulnerability that can cause arbitrary code to execute in a victim's browser.