CVE-2026-59670: Multiple vulnerabilities in the Repasat application

Published Oct 2, 2026

Updated

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomListaValidacion” parameter is affected – endpoint “/es/validationslists/assignList/Employee/45659”.

Affected Software

1 affected component

Repasat Repasat

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Repasat application to a version that resolves this vulnerability.
Fixed in 20260402

Event History

Oct 2, 2026

CVE Published

via MITRE·09:01 AM

Data Sourced

via MITRE·09:01 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·09:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access and user interaction are required to exploit this issue?

The attacker needs low-level privileges and must persuade a user to interact with the malicious content. Exploitation results in arbitrary code executing in the victim's browser.

Which input and endpoint should be reviewed during triage?

Review handling of the nomListaValidacion parameter at the /es/validationslists/assignList/Employee/45659 endpoint. The provided data identifies this parameter and endpoint as affected.

CVE-2026-59670: Multiple vulnerabilities in the Repasat application

Affected Software

Remediation

Event History

Frequently Asked Questions

What access and user interaction are required to exploit this issue?

Which input and endpoint should be reviewed during triage?

Company

Resources

Contact

Frequently Asked Questions

What access and user interaction are required to exploit this issue?

Which input and endpoint should be reviewed during triage?