CVE-2026-79419: n/a

This vulnerability involves a reflected XSS flaw in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The root cause is inadequate input validation and sanitization of the 'mensagem' parameter in the /Configuracao/Imagens.aspx endpoint. An attacker with authentication privileges can craft malicious JavaScript code that is reflected back to the victim's browser, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 score is 8.7, indicating a high impact on confidentiality and integrity, with no impact on availability. No known exploits in the wild or vendor patches are documented.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser, potentially compromising user sessions and data confidentiality and integrity. The vulnerability does not affect system availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected endpoint to trusted users only and consider implementing additional input validation or web application firewall (WAF) rules to detect and block malicious payloads targeting the 'mensagem' parameter.