CVE-2026-59669 describes a Cross-Site Scripting vulnerability in the Repasat application. The issue is located in the 'name' parameter of the endpoint '/es/attachmenttypes/update/203336'. Successful exploitation may enable an attacker to execute arbitrary code in the context of the victim's browser session. The vulnerability has a CVSS 4.0 vector indicating network attack vector, low attack complexity, no privileges required, and user interaction required, with low confidentiality and integrity impact. No patch or vendor advisory information is available.

An attacker could exploit this vulnerability to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions within the context of the affected application. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid interacting with suspicious links or inputs related to the affected endpoint and consider applying input validation or web application firewall rules if possible.