CVE-2026-95662: Multiple vulnerabilities in the Repasat application
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected – endpoint “/es/competitors/store”.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Repasat applicationto a version that resolves this vulnerability.Fixed in 20260402
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates low attacker privileges are required. Exploitation also requires user interaction, meaning an attacker would need to cause a victim to interact with malicious content that triggers the affected nomCompetidor parameter.
Which application component should be investigated?
Review handling of the nomCompetidor parameter at the /es/competitors/store endpoint. This is the parameter and endpoint identified as affected by the cross-site scripting vulnerability.
What is the likely impact if exploitation succeeds?
Successful exploitation can cause arbitrary code to execute in the victim's browser. The CVSS vector indicates low impact to the confidentiality and integrity of the vulnerable system, with no availability impact listed.