CVE-2026-5699
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application allows an attacker to store JavaScript code that executes in the victim's browser when the page is viewed. The affected parameter is 'companyName' in the /empresa endpoint.
Risk Assessment
Malicious script can execute in the browsers of users viewing the infected page, enabling session theft or actions performed on behalf of the victim. The risk affects users visiting the /empresa endpoint.
Recommendation
Update SABBATIC to a patched version and implement input validation and output encoding for the 'companyName' parameter.
Other vulnerabilities in SABBATIC
See all- CVE-2026-5702Medium
A Cross-Site Request Forgery (CSRF) vulnerability in the SABBATIC application allows an attacker to trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint.
- CVE-2026-5700Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application allows an attacker to store JavaScript code that executes in the victim's browser when the page is viewed. The affected parameter is 'observaciones' in the /mis-gastos endpoint.
- CVE-2026-5698Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application allows an attacker to store JavaScript code that executes in the victim's browser when the page is viewed. The affected parameters are 'titulo_es' and 'add_etiquetas[]' in the /categorías endpoint.
- CVE-2026-5697Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application allows an attacker to store JavaScript code that executes in the victim's browser when the page is viewed. The affected parameter is 'nombre' in the /usuario endpoint.
Original NVD description (English source)
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows: parameter 'companyName' in /empresa endpoint;
Vulnerability data from NVD (NIST) · CISA KEV · EPSS