CVE-2026-95662 describes a Cross-Site Scripting vulnerability in the Repasat application. The vulnerability affects the 'nomCompetidor' parameter on the '/es/competitors/store' endpoint. Successful exploitation could enable an attacker to execute arbitrary code in the context of the victim's browser session. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, and low impact on confidentiality and integrity but no impact on availability. No known exploits or patches are currently documented.

If exploited, this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to the client side and requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with the affected endpoint and avoid untrusted input. No official fix or workaround has been documented.