Stored Cross-Site Scripting Vulnerability in SABBATIC Application by SABBATIC
CVE-2026-5699

4.8MEDIUM

Key Information:

Vendor

Sabbatic

Status
Sabbatic App
Vendor
CVE Published:
29 October 2026

What is CVE-2026-5699?

The SABBATIC application has a Stored Cross-Site Scripting (XSS) vulnerability that allows attackers to store malicious JavaScript code. When users view the affected webpage, this code executes in their browsers, potentially compromising user data and session integrity. This vulnerability affects parameters in the /empresa endpoint, most notably the 'companyName' parameter, making it essential for developers to implement proper input validation and sanitization measures.

Affected Version(s)

SABBATIC app versions prior to 7.96.0.1 y 7.96.0.2

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

David Padilla Alvarado
Víctor Manuel Pérez Cámara
.