# CVE-2026-59668: Repasat application cross-site scripting in company size parameter

Source: https://junglewise.ai/threats/cve-2026-59668-cross-site-scripting-vulnerability-in-the-repasat-application  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-59668 · Severity: info · Published 2026-10-02

Repasat is a business management platform that consolidates operations for companies. A cross-site scripting vulnerability in the company size parameter allows attackers to trick users into executing malicious code in their browsers, potentially compromising user sessions or stealing sensitive business data.

Technologies: [Repasat](https://junglewise.ai/threats/technologies/repasat). Vendors: [Repasat](https://junglewise.ai/threats/vendors/repasat).

## Quick answers

**Is CVE-2026-59668 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59668 being exploited in the wild.

**How severe is CVE-2026-59668?** Informational severity, published 2 October 2026.

**Which products and versions are affected?** Repasat before 20260402.

**Is there a fix for CVE-2026-59668?** Yes: fixed in 20260402. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59668 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-59668?** Check whether you run Repasat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 20260402

## Technical details

A reflected cross-site scripting (CWE-79) vulnerability exists in the Repasat application's "/es/companysizebills/store" endpoint via the "nomTamano" parameter. The vulnerability requires authentication and user interaction to exploit. Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser context.

## Affected products

- Repasat Repasat before 20260402

## Timeline

- 2026-10-02: disclosed

## References

- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application)

## Related threats

- [Repasat cross-site scripting in company size employees endpoint](https://junglewise.ai/threats/cve-2026-59667-cross-site-scripting-vulnerability-in-the-repasat-application)
- [Repasat business management software XSS vulnerabilities](https://junglewise.ai/threats/cve-2026-59666-cross-site-scripting-vulnerability-in-the-repasat-application)
- [Repasat cross-site scripting in parameters](https://junglewise.ai/threats/cve-2026-95662-cross-site-scripting-vulnerability-in-the-repasat-application)
- [Repasat multiple cross-site scripting vulnerabilities](https://junglewise.ai/threats/cve-2026-59673-cross-site-scripting-vulnerability-in-the-repasat-application)
- [Repasat cross-site scripting in corporate group management](https://junglewise.ai/threats/cve-2026-59672-cross-site-scripting-vulnerability-in-the-repasat-application)