CVE-2026-59673: Multiple vulnerabilities in the Repasat application

Published Oct 2, 2026

Updated

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTipoCli” parameter is affected – endpoint “/es/clientypes/update/109441”.

Affected Software

1 affected component

Repasat Repasat

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Repasat application to a version that resolves this vulnerability.
Fixed in 20260402

Event History

Oct 2, 2026

CVE Published

via MITRE·09:12 AM

Data Sourced

via MITRE·09:12 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker have or do to exploit this issue?

The CVSS vector indicates network access, low attack complexity, and low privileges are required. Exploitation also requires user interaction, meaning the attacker must induce a victim to execute the injected content in their browser.

What is the expected security impact if exploitation succeeds?

The reported impact is low for confidentiality and integrity, with no availability impact. The described outcome is arbitrary code execution in the victim's browser.

How narrowly can affected deployments be identified from the available information?

The available information identifies the affected parameter as “nomTipoCli” at “/es/clientypes/update/109441”. It does not provide affected version numbers or state whether the vulnerable behavior is present in a default configuration.

CVE-2026-59673: Multiple vulnerabilities in the Repasat application

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker have or do to exploit this issue?

What is the expected security impact if exploitation succeeds?

How narrowly can affected deployments be identified from the available information?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker have or do to exploit this issue?

What is the expected security impact if exploitation succeeds?

How narrowly can affected deployments be identified from the available information?