{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1959", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "state": "PUBLISHED", "assignerShortName": "INCIBE", "dateReserved": "2026-02-05T10:39:17.734Z", "datePublished": "2026-02-09T11:41:07.740Z", "dateUpdated": "2026-02-09T13:12:59.317Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Loggro Pymes", "vendor": "Loggro Pymes", "versions": [{"lessThan": "1.0.124", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:loggro_pymes:loggro_pymes:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.0.124", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "David Padilla Alvarado"}], "datePublic": "2026-02-06T11:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the \n\n<span style=\"background-color: rgb(255, 255, 255);\">'descripci\u00f3n'</span>\n\nparameter in the '/loggrodemo/jbrain/MaestraCuentasBancarias' endpoint."}], "value": "Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the \n\n'descripci\u00f3n'\n\nparameter in the '/loggrodemo/jbrain/MaestraCuentasBancarias' endpoint."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2026-02-09T11:41:07.740Z"}, "references": [{"tags": ["patch"], "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-loggro-pymes-web-application"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The vulnerabilities have been fixed by Loggro Pymes team in version 1.0.124."}], "value": "The vulnerabilities have been fixed by Loggro Pymes team in version 1.0.124."}], "source": {"discovery": "EXTERNAL"}, "title": "Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T13:11:58.933741Z", "id": "CVE-2026-1959", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T13:12:59.317Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1959", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T13:11:58.933741Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T13:12:29.304Z"}}], "cna": {"title": "Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "David Padilla Alvarado"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Loggro Pymes", "product": "Loggro Pymes", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.124", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The vulnerabilities have been fixed by Loggro Pymes team in version 1.0.124.", "supportingMedia": [{"type": "text/html", "value": "The vulnerabilities have been fixed by Loggro Pymes team in version 1.0.124.", "base64": false}]}], "datePublic": "2026-02-06T11:00:00.000Z", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-loggro-pymes-web-application", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the \n\n'descripci\u00f3n'\n\nparameter in the '/loggrodemo/jbrain/MaestraCuentasBancarias' endpoint.", "supportingMedia": [{"type": "text/html", "value": "Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the \n\n<span style=\"background-color: rgb(255, 255, 255);\">'descripci\u00f3n'</span>\n\nparameter in the '/loggrodemo/jbrain/MaestraCuentasBancarias' endpoint.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:loggro_pymes:loggro_pymes:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.124", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2026-02-09T11:41:07.740Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1959", "state": "PUBLISHED", "dateUpdated": "2026-02-09T13:12:59.317Z", "dateReserved": "2026-02-05T10:39:17.734Z", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "datePublished": "2026-02-09T11:41:07.740Z", "assignerShortName": "INCIBE"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Loggro Pymes", "vendor": "Loggro Pymes", "versions": [{"lessThan": "1.0.124", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cve-coordination@incibe.es"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the \n\n'descripci\u00f3n'\n\nparameter in the '/loggrodemo/jbrain/MaestraCuentasBancarias' endpoint."}, {"lang": "es", "value": "Vulnerabilidad de cross-site scripting (XSS) almacenado en Loggro Pymes, a trav\u00e9s del par\u00e1metro 'descripci\u00f3n' en el endpoint '/loggrodemo/jbrain/MaestraCuentasBancarias'."}], "id": "CVE-2026-1959", "lastModified": "2026-06-17T10:16:46.690", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve-coordination@incibe.es", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1959", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T13:11:58.933741Z", "version": "2.0.3"}}]}, "published": "2026-02-09T12:15:57.767", "references": [{"source": "cve-coordination@incibe.es", "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-loggro-pymes-web-application"}], "sourceIdentifier": "cve-coordination@incibe.es", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cve-coordination@incibe.es", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.0.124)"}}], "product": "loggro_pymes", "vendor": "loggro_pymes"}], "analysis": {"en": {"generated_at": "2026-04-17T21:27:08.599617+00:00", "value": {"mitigation_remediation": ["Apply the Loggro Pymes patch 1.0.124 or newer to eliminate the stored XSS vector", "If an immediate upgrade is not feasible, sanitize the 'descripci\u00f3n' input on the server side, ensuring all HTML and script content is escaped before storage or block disallowed tags", "Deploy a web application firewall or content security policy that blocks execution of inline scripts to mitigate any remaining risk"], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "The flaw affects all Loggro Pymes installations that run versions prior to 1.0.124. The Loggro Pymes Web Application, managed by Loggro Pymes, is the impacted product. Users running earlier releases should verify their current build and plan for an update as the vendor has supplied a fix in version 1.0.124.", "description_and_impact": "The vulnerability is a stored cross\u2011site scripting flaw that allows an attacker to inject malicious JavaScript through the 'descripci\u00f3n' parameter of the '/loggrodemo/jbrain/MaestraCuentasBancarias' endpoint. When the content is later displayed to other users, the injected script will execute in their browsers, enabling actions such as session hijacking, cookie theft, and defacement. This is a classic example of CWE\u201179, where unsanitized user input is persisted and rendered without proper escaping.", "risk_and_exploitability": "The CVSS score of 5.1 classifies the issue as moderate in severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no active widely known attacks have been reported. An attacker could exploit the flaw by submitting a crafted value to the 'descripci\u00f3n' field, which is then stored and replayed for other users, making the attack vector primarily remote and web\u2011based."}}}}, "created": "2026-02-10T12:23:40.135509+00:00", "updated": "2026-04-17T21:30:28.392670+00:00", "vendors": ["loggro_pymes", "loggro_pymes$PRODUCT$loggro_pymes"]}