Stored Cross-Site Scripting Vulnerability in SABBATIC Application
CVE-2026-5697

4.8MEDIUM

Key Information:

Vendor

Sabbatic

Status
Sabbatic App
Vendor
CVE Published:
29 October 2026

What is CVE-2026-5697?

The SABBATIC application is vulnerable to stored Cross-Site Scripting (XSS), enabling attackers to inject malicious JavaScript code. When users access affected pages, the code executes in their browsers, potentially leading to session hijacking, data theft, or other security breaches. The vulnerability is linked to the 'nombre' parameter in the '/usuario' endpoint, which fails to adequately sanitize user input.

Affected Version(s)

SABBATIC app versions prior to 7.96.0.1 y 7.96.0.2

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

David Padilla Alvarado
Víctor Manuel Pérez Cámara
.