CVE-2026-59669: Multiple vulnerabilities in the Repasat application

Published Oct 2, 2026

Updated

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “name” parameter is affected – endpoint “/es/attachmenttypes/update/203336”

Affected Software

1 affected component

Repasat

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Repasat application to a version that resolves this vulnerability.
Fixed in 20260402

Event History

Oct 2, 2026

CVE Published

via MITRE·08:40 AM

Data Sourced

via MITRE·08:40 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·09:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access and user interaction are required for exploitation?

The CVSS vector indicates that an attacker needs low-level privileges and that user interaction is required. The attack can be performed over the network with low attack complexity and no additional attack conditions.

Which application input is identified as vulnerable?

The affected input is the “name” parameter at the /es/attachmenttypes/update/203336 endpoint.

What is the likely impact if exploitation succeeds?

An attacker may trick a user into executing arbitrary code in that user’s browser. The CVSS vector indicates low confidentiality and integrity impact, with no availability impact.

CVE-2026-59669: Multiple vulnerabilities in the Repasat application

Affected Software

Remediation

Event History

Frequently Asked Questions

What access and user interaction are required for exploitation?

Which application input is identified as vulnerable?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What access and user interaction are required for exploitation?

Which application input is identified as vulnerable?

What is the likely impact if exploitation succeeds?