A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. (CVE-2026-79419)

The vulnerability in EMX Tecnologia Gestao X Business Suite 8.4 and earlier is a reflected XSS caused by improper input validation of the 'mensagem' parameter at the /Configuracao/Imagens.aspx endpoint. This allows an unauthenticated attacker to craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript code within the victim's browser session. No CVSS score or detailed impact metrics are provided. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, defacement, or redirection to malicious sites. However, no active exploitation has been reported, and the impact depends on victim interaction with a crafted URL.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when clicking on untrusted links targeting the affected endpoint. Implementing web application firewall (WAF) rules to detect and block suspicious input to the 'mensagem' parameter may provide temporary mitigation.