{"id":"CVE-2026-124637","published":"2026-11-09T10:17:09.827","lastModified":"2026-11-09T10:17:09.827","description":"A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a request to https://www.luxorgymtarrega.com/dadespersonals/modificarClient/ID. User-provided data is neither validated nor escaped before being displayed in the HTML response and stored in the database, allowing arbitrary JavaScript code to be executed in the victim’s browser.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-tankuam-places","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}