CVE-2026-59664 in Repasat
Summary
by MITRE • 10/02/2026
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomServicioPrestado” parameter is affected – endpoint “/es/providedservices/store”.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The identified Cross-Site Scripting (XSS) vulnerability within the Repasat application represents a significant security risk that compromises the integrity and confidentiality of user interactions. This flaw specifically targets the nomServicioPrestado parameter, which is processed via the /es/providedservices/store endpoint. The core technical issue stems from insufficient validation or sanitization of input data provided by users before it is reflected back in the application's response. When an attacker crafts a malicious payload containing executable JavaScript code and injects it into this specific parameter, the web server accepts the input without adequate filtering. Consequently, when another user accesses the affected page or endpoint that renders this stored data, the browser interprets the injected script as legitimate content originating from the trusted domain of Repasat. This mechanism allows the malicious script to execute within the context of the victim's session, effectively bypassing same-origin policy restrictions that are designed to prevent such unauthorized access.
The operational impact of exploiting this vulnerability is severe and multifaceted. By tricking a user into executing arbitrary code in their browser, an attacker can perform a wide range of malicious activities. These include stealing sensitive information such as session cookies, authentication tokens, or personally identifiable information displayed on the page. Furthermore, the attacker could manipulate the DOM to alter the appearance or functionality of the application, potentially leading users to enter credentials into fake login forms designed by the attacker through phishing techniques embedded within the compromised interface. In more advanced scenarios, the script can act as a keylogger, recording keystrokes to capture passwords and other sensitive data entered during the browsing session. This not only jeopardizes individual user accounts but also poses a substantial risk to organizational security if administrative credentials or internal corporate data are exposed through this vector.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). Specifically, since the payload is stored via the /es/providedservices/store endpoint and subsequently served to other users, it falls under Stored XSS, which is considered more dangerous than reflected XSS due to its persistent nature. In terms of offensive security frameworks, this exploitation technique maps directly to MITRE ATT&CK tactic TA0001: Initial Access, specifically the T1189 Drive-by Compromise or T1566 Phishing sub-techniques where malicious scripts are delivered via compromised web content. It also relates to TA0005: Defense Evasion and TA0007: Discovery as the attacker gathers information about the victim's environment and session state without detection by standard security controls that do not inspect client-side script execution contexts.
To mitigate this vulnerability, immediate remediation steps must focus on implementing robust input validation and output encoding strategies at both the application layer and potentially within a Web Application Firewall (WAF). Developers should ensure that all data received from users via the nomServicioPrestado parameter is strictly validated against expected formats, rejecting any input containing special characters or script tags unless they are part of an allowed whitelist. More critically, when rendering this data back to the browser, it must be properly encoded using context-aware output encoding techniques such as HTML entity encoding for content placed within HTML body elements, JavaScript escaping for inline scripts, and URL encoding for query parameters. Additionally, implementing Content Security Policy (CSP) headers can significantly reduce the impact of any successful XSS attacks by restricting the sources from which scripts are allowed to load and execute. Regular security testing, including dynamic application security testing (DAST) and manual penetration testing focused on input handling, should be integrated into the development lifecycle to detect and prevent similar flaws in future releases.