PT-2026-6904 · Unknown · Loggro Pymes

Published 2026-02-07 · Updated 2026-02-09 · CVE-2026-1959

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Loggro Pymes version 1.0.124

Description A stored Cross-Site Scripting (XSS) issue exists in Loggro Pymes. The issue is located in the /loggrodemo/jbrain/MaestraCuentasBancarias API endpoint, specifically through the descripción parameter. Successful exploitation could allow an attacker to inject malicious scripts that execute in the context of other users' browsers.

Recommendations Update Loggro Pymes to a version that addresses this issue. As a temporary workaround, sanitize the descripción parameter to prevent the injection of malicious scripts.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1959

Affected Products

Loggro Pymes

References · 6

• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-loggro-pymes-web-application · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-1959 · Security Note
• https://twitter.com/VulmonFeeds/status/2020884060529123579 · Twitter Post
• https://t.me/cveNotify/151399 · Telegram Post
• https://t.me/CVEtracker/44209 · Telegram Post
• https://twitter.com/ciberpadi/status/2020048898040238316 · Twitter Post