---
id: CVE-2026-5699
title: Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
summary: >-
  Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that
  allows an attacker to store JavaScript code so that when a user views the
  page, code can be executed in the victim's browser. The list of assigned
  parameters an…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: SABBATIC
product: SABBATIC app
affected:
  - app versions prior to 7.96.0.1 y 7.96.0.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T12:52:58.531844Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T13:07:11.952Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-5699'
references:
  - url: >-
      https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sabbatic-application
tags:
  - cve.org
epss: 0.003
epssPercentile: 0.22789
ingestedAt: '2026-11-01T18:59:04.475Z'
---

## Overview

Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows: 
 parameter 'companyName' in  /empresa  endpoint;

## Affected

- `app versions prior to 7.96.0.1 y 7.96.0.2`

## Remediation

The vulnerabilities have been fixed by SABBATIC team in versions 7.96.0.1 y 7.96.0.2