EUVD Vulnerability Catalog

EUVD-2026-119891

Severity: MEDIUM Base Score: 5.3 CVSS Version: 4.0

Vulnerability Description

A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a request to https://www.luxorgymtarrega.com/dadespersonals/modificarClient/ID. User-provided data is neither validated nor escaped before being displayed in the HTML response and stored in the database, allowing arbitrary JavaScript code to be executed in the victim’s browser.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Attack Requirements (AT): None

▪ Privileges Required (PR): None

▪ User Interaction (UI): Passive

▪ Vulnerability Confidentiality Impact (VC): Low

▪ Vulnerability Integrity Impact (VI): Low

▪ Vulnerability Availability Impact (VA): None

▪ Subsequent Confidentiality Impact (SC): None

▪ Subsequent Integrity Impact (SI): None

▪ Subsequent Availability Impact (SA): None

Affected Vendors & Systems

Vendor Kompini

References & Advisory Links

https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-tankuam-places

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

INCIBE

EPSS Probability

Known Aliases

CVE-2026-124637

Published On

2026-11-09

Last Updated

2026-11-09