Medium severity · published Oct 29, 2026
CVE-2026-5697
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
New
4.8
CVSS
–
EPSS
No
On KEV
Description
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows:
parameter 'nombre' in '/usuario' endpoint;
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
SABBATIC app · SABBATIC
versions prior to 7.96.0.1 y 7.96.0.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5697
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5697
www.incibe.es
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sabbatic-application
More from SABBATIC app
4.8
CVE-2026-5702
Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application
4.8
CVE-2026-5700
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
4.8
CVE-2026-5699
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
4.8
CVE-2026-5698
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
