Medium severity · published Oct 29, 2026
CVE-2026-5698
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
New
4.8
CVSS
–
EPSS
No
On KEV
Description
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows:  parameters 'titulo_es' and 'add_etiquetas%5B%5D' in '/categorías' endpoint;
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
SABBATIC app · SABBATIC
versions prior to 7.96.0.1 y 7.96.0.2 · source: vendor
Affected product
SA
SABBATIC app
SABBATIC
More from SABBATIC app
4.8
CVE-2026-5702
Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application
4.8
CVE-2026-5700
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
4.8
CVE-2026-5699
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
4.8
CVE-2026-5697
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application