CVE-2026-59666: Multiple vulnerabilities in the Repasat application

Published Oct 2, 2026

Updated

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomOrigen” parameter is affected – endpoint “/es/origins/store”.

Affected Software

1 affected component

Repasat

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Repasat application to a version that resolves this vulnerability.
Fixed in 20260402

Event History

Oct 2, 2026

CVE Published

via MITRE·10:12 AM

Data Sourced

via MITRE·10:12 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required for exploitation?

The CVSS vector indicates network access, low privileges, and user interaction are required. An attacker would need to cause a user to interact with the malicious content for the browser-side code execution to occur.

What impact is indicated if exploitation succeeds?

The CVSS assessment indicates low-impact compromise of confidentiality and integrity, with no availability impact. The affected security scope is limited to the vulnerable application’s context.