Stored Cross-Site Scripting (XSS) in Tankuam Places
Tankuam Places, versions prior to app.00007.00005 (December 2025).
INCIBE has coordinated the disclosure of a medium-severity vulnerability affecting Tankuam Places by Kompini, software for managing municipal facilities. The vulnerability was discovered by Arnau Domènech Bravin.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type:
- CVE-2026-124637: CVSS v4.0: 5.3 | CVSS AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | CWE-79
The vulnerability has been fixed by the Kompini team in version apl.00007.00005 (December 2025).
CVE-2026-124637: A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a request to https://www.luxorgymtarrega.com/dadespersonals/modificarClient/ID. User-provided data is neither validated nor escaped before being displayed in the HTML response and stored in the database, allowing arbitrary JavaScript code to be executed in the victim’s browser.
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-124637 | Media | No | Kompini |
