Stored Cross-Site Scripting Vulnerability in SABBATIC Application
CVE-2026-5700

4.8MEDIUM

Key Information:

Vendor

Sabbatic

Status
Sabbatic App
Vendor
CVE Published:
29 October 2026

What is CVE-2026-5700?

A stored cross-site scripting vulnerability exists in the SABBATIC application, allowing attackers to inject malicious JavaScript code. When a user accesses the compromised page, the malicious script executes within the user’s browser context. This can lead to unauthorized actions and compromise user data. The vulnerability affects the 'observaciones' parameter in the /mis-gastos endpoint, posing significant risks for end users.

Affected Version(s)

SABBATIC app versions prior to 7.96.0.1 y 7.96.0.2

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

David Padilla Alvarado
Víctor Manuel Pérez Cámara
.