CVE-2026-59662 describes a Cross-Site Scripting vulnerability in the Repasat application. The vulnerability is located in the 'nomCompetidor' parameter of the '/es/competitors/store' endpoint. Successful exploitation enables an attacker to execute arbitrary code in the victim's browser context. The vulnerability has been assigned a medium severity rating. No known exploits in the wild or vendor-provided patches have been reported at this time.

If exploited, this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is limited by the need for user interaction and the vulnerability's medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted input in the affected application. No vendor advisory or patch links are currently provided.