CVE-2026-124637 in Tankuam Places
Summary
by MITRE • 11/09/2026
A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a request to https://www.luxorgymtarrega.com/dadespersonals/modificarClient/ID. User-provided data is neither validated nor escaped before being displayed in the HTML response and stored in the database, allowing arbitrary JavaScript code to be executed in the victim’s browser.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/09/2026
The identified vulnerability constitutes a Stored Cross-Site Scripting flaw within the profile editing functionality of the web application hosted at luxorgymtarrega.com. This specific security weakness is located in two input parameters, cliNom and cliCognoms, which are submitted via an HTTP request to the endpoint dadespersonals/modificarClient/ID. The core technical failure lies in the server-side processing logic, where user-supplied data from these fields is persisted into the backend database without undergoing any form of validation or sanitization. Furthermore, when this stored data is subsequently retrieved and rendered back to users within HTML responses, it is not escaped against script execution contexts. This lack of output encoding allows an attacker to inject malicious JavaScript payloads that are permanently stored on the server, ensuring that every user who views the compromised profile will have their browser execute the injected code automatically upon page load.
From a technical perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific subtype here is Stored XSS, also referred to as Persistent XSS, because the malicious script resides on the target server rather than being delivered temporarily via a link or form submission that requires immediate user interaction for execution. This persistence distinguishes it from Reflected XSS and significantly increases its severity rating within industry standards such as OWASP Top 10, where Stored XSS is consistently ranked among the most critical web application security risks due to its ability to affect multiple victims without further effort from the attacker after initial exploitation.
The operational impact of this vulnerability extends beyond simple script execution. An adversary can leverage this flaw to perform session hijacking by stealing authentication cookies or tokens displayed in clear text within browser storage, thereby gaining unauthorized access to victim accounts with elevated privileges if the compromised user has administrative rights. Additionally, attackers may deploy keyloggers to capture sensitive credentials entered on subsequent pages, deface the website content for reputational damage, or redirect users to malicious phishing sites designed to harvest personal information. Since the payload is stored in fields related to client names and surnames, it targets a high-visibility area of the application, increasing the likelihood that legitimate administrators or other clients will encounter the malicious script during routine operations.
To mitigate this vulnerability, immediate remediation steps must focus on implementing robust input validation and output encoding strategies at both the application layer and database interaction layers. Input validation should enforce strict whitelisting for the cliNom and cliCognoms parameters, allowing only alphanumeric characters and standard punctuation while rejecting any HTML tags or script-like syntax. More critically, all dynamic content rendered in HTML responses must be properly encoded using context-aware output encoding techniques such as HTML entity encoding to ensure that special characters are treated as data rather than executable code. Developers should also consider implementing Content Security Policy headers to provide an additional layer of defense by restricting the sources from which scripts can be loaded and executed within the browser environment, thereby limiting the impact even if a bypass occurs.
Long-term security improvements should involve adopting secure coding practices that prioritize safety over convenience during development cycles. This includes utilizing modern web frameworks that automatically handle output encoding for common contexts or employing dedicated libraries designed to sanitize user input before database storage. Regular security assessments, including both automated static application security testing and manual penetration testing focused on injection flaws, are essential to identify similar vulnerabilities across other forms and endpoints within the application architecture. By addressing this Stored XSS flaw comprehensively, the organization can significantly reduce its attack surface and protect user data integrity against persistent web-based attacks categorized under MITRE ATT&CK technique T1059 as Command and Scripting Interpreter via browser-side execution vectors.