PT-2026-6905 · Unknown · Loggro Pymes

Published 2026-02-07 · Updated 2026-02-09 · CVE-2026-1960

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Loggro Pymes (affected versions not specified)

Description A stored Cross-Site Scripting (XSS) issue exists in Loggro Pymes. The issue is related to the 'Facebook' parameter within the /loggrodemo/jbrain/ConsultaTerceros API endpoint. Successful exploitation could allow an attacker to inject malicious scripts into web pages viewed by other users. The Facebook parameter is the entry point for the attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1960

Affected Products

Loggro Pymes

References · 7

• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-loggro-pymes-web-application · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-1960 · Security Note
• https://twitter.com/VulmonFeeds/status/2020878940378730890 · Twitter Post
• https://twitter.com/CVEnew/status/2020831625970352528 · Twitter Post
• https://twitter.com/ciberpadi/status/2020048898040238316 · Twitter Post
• https://t.me/cveNotify/151400 · Telegram Post
• https://t.me/CVEtracker/44210 · Telegram Post