4.8
MediumCVSS 4.0 · from INCIBE
CVE-2026-5699
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
SABBATIC app · Cross-site scripting · CWE-79AffectedSABBATIC app
FixNo fix listed yet.
PublishedOct 29, 11:16 · INCIBE
ScoredOct 29 · 4.8 · INCIBE
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows: parameter 'companyName' in /empresa endpoint;
From INCIBE
Affected and fixed versions
ProductAffectedFixed inSABBATIC appversions prior to 7.96.0.1 y 7.96.0.2–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known