# CVE-2026-59662: Repasat Cross-Site Scripting in competitor parameter

Source: https://junglewise.ai/threats/cve-2026-59662-cross-site-scripting-vulnerability-in-the-repasat-application  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-59662 · Severity: info · Published 2026-10-02

Repasat is business management software that consolidates company operations onto a single platform. A cross-site scripting (XSS) flaw in the competitor management endpoint allows an authenticated attacker to inject malicious scripts that execute in a user's browser, potentially enabling session hijacking, credential theft, or malware distribution.

Technologies: [Repasat](https://junglewise.ai/threats/technologies/repasat). Vendors: [Repasat](https://junglewise.ai/threats/vendors/repasat).

## Quick answers

**Is CVE-2026-59662 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59662 being exploited in the wild.

**How severe is CVE-2026-59662?** Informational severity, published 2 October 2026.

**Which products and versions are affected?** Repasat prior to 20260402.

**Is there a fix for CVE-2026-59662?** Yes: fixed in 20260402. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59662 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-59662?** Check whether you run Repasat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 20260402

## Technical details

A stored cross-site scripting vulnerability exists in the "nomCompetidor" parameter of the /es/competitors/store endpoint. The vulnerability requires an authenticated user and user interaction (visiting a malicious page), and allows an attacker to inject arbitrary JavaScript that executes in the victim's browser context. The fix is available in patch version 20260402.

## Affected products

- REPASAT Repasat prior to 20260402

## Timeline

- 2026-10-02: disclosed

## References

- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application)

## Related threats

- [Repasat application cross-site scripting in company size parameter](https://junglewise.ai/threats/cve-2026-59668-cross-site-scripting-vulnerability-in-the-repasat-application)
- [Repasat cross-site scripting in company size employees endpoint](https://junglewise.ai/threats/cve-2026-59667-cross-site-scripting-vulnerability-in-the-repasat-application)
- [Repasat business management software XSS vulnerabilities](https://junglewise.ai/threats/cve-2026-59666-cross-site-scripting-vulnerability-in-the-repasat-application)
- [Repasat cross-site scripting in parameters](https://junglewise.ai/threats/cve-2026-95662-cross-site-scripting-vulnerability-in-the-repasat-application)
- [Repasat multiple cross-site scripting vulnerabilities](https://junglewise.ai/threats/cve-2026-59673-cross-site-scripting-vulnerability-in-the-repasat-application)