Description
A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a request to https://www.luxorgymtarrega.com/dadespersonals/modificarClient/ID. User-provided data is neither validated nor escaped before being displayed in the HTML response and stored in the database, allowing arbitrary JavaScript code to be executed in the victim’s browser.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kompini | Tankuam Places | versions prior to app.00007.00005 (December 2025) | — |