Multiple vulnerabilities in SABBATIC application
SABBATIC.
INCIBE has coordinated the publication of 5 medium severity vulnerability, affecting SABBATIC application, software for digitizing expense receipts and invoices. The vulnerabilities were discovered by David Padilla Alvarado y Víctor Manuel Pérez Cámara.
These vulnerabilities have been assigned the following codes, CVSS v4.0 base score, CVSS vector and CWE vulnerability type for each vulnerability:
- From CVE-2026-5697 to CVE-2026-5700: 4.8 | CVSS:4.0/ AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | CWE-79
- CVE-2026-5702: CVSS v4.0: 4.8 | CVSS AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | CWE-352
The vulnerabilities have been fixed by SABBATIC team in versions 7.96.0.1 y 7.96.0.2
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows:
- CVE-2026-5697: parameter 'nombre' in '/usuario' endpoint;
- CVE-2026-5698: parameters 'titulo_es' and 'add_etiquetas%5B%5D' in '/categorías' endpoint;
- CVE-2026-5699: parameter 'companyName' in /empresa endpoint;
- CVE-2026-5700: parameter 'observaciones' in /mis-gastos endpoint.
CVE-2026-5702: Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint.
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-5697 | Media | No | SABBATIC |
| CVE-2026-5698 | Media | No | SABBATIC |
| CVE-2026-5699 | Media | No | SABBATIC |
| CVE-2026-5700 | Media | No | SABBATIC |
| CVE-2026-5702 | Media | No | SABBATIC |
