Skip to content
OpenAdvisories
Medium · 4.8 CVE-2026-59666 EUVD-2026-91365GHSA-fc2r-3669-p6fh

Multiple vulnerabilities in the Repasat application

Published Oct 2, 2026 · Updated Oct 6, 2026 · Assigned by INCIBE

Description

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomOrigen” parameter is affected – endpoint “/es/origins/store”.

Affected products

VendorProductAffectedFixed
Repasat Repasat application < Abril patch "20260402" Abril patch "20260402"

References