{"id":"CVE-2026-5699","title":"Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application","summary":"Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters an…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"SABBATIC","product":"SABBATIC app","affected":["app versions prior to 7.96.0.1 y 7.96.0.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-29T12:52:58.531844Z"},"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T13:07:11.952Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-5699","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sabbatic-application"}],"tags":["cve.org"],"epss":0.003,"epssPercentile":0.22789,"ingestedAt":"2026-11-01T18:59:04.475Z","slug":"CVE-2026-5699","body":"## Overview\n\nStored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows: \n parameter 'companyName' in  /empresa  endpoint;\n\n## Affected\n\n- `app versions prior to 7.96.0.1 y 7.96.0.2`\n\n## Remediation\n\nThe vulnerabilities have been fixed by SABBATIC team in versions 7.96.0.1 y 7.96.0.2","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}