CVE-2026-1960 - Vulnerability Details - OpenCVE

Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'Facebook' parameter in '/loggrodemo/jbrain/ConsultaTerceros' endpoint.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Loggro Pymes	Loggro Pymes

No data.

No data.

References

Link	Providers
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-loggro-pymes-web-application

History

Mon, 09 Feb 2026 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 09 Feb 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'Facebook' parameter in '/loggrodemo/jbrain/ConsultaTerceros' endpoint.
Title		Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes
First Time appeared		Loggro Pymes Loggro Pymes loggro Pymes
Weaknesses		CWE-79
CPEs		cpe:2.3:a:loggro_pymes:loggro_pymes::::::::
Vendors & Products		Loggro Pymes Loggro Pymes loggro Pymes
References		https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-loggro-pymes-web-application
Metrics		cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: INCIBE

Published: 2026-02-09T11:41:37.382Z

Updated: 2026-02-09T13:04:04.602Z

Reserved: 2026-02-05T10:40:49.603Z

Link: CVE-2026-1960

Vulnrichment

Updated: 2026-02-09T13:03:04.358Z

NVD

Status : Received

Published: 2026-02-09T12:15:57.940

Modified: 2026-02-09T12:15:57.940

Link: CVE-2026-1960

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1960", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "state": "PUBLISHED", "assignerShortName": "INCIBE", "dateReserved": "2026-02-05T10:40:49.603Z", "datePublished": "2026-02-09T11:41:37.382Z", "dateUpdated": "2026-02-09T13:04:04.602Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Loggro Pymes", "vendor": "Loggro Pymes", "versions": [{"lessThan": "1.0.124", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:loggro_pymes:loggro_pymes:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.0.124", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "David Padilla Alvarado"}], "datePublic": "2026-02-06T11:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'Facebook' parameter in '/loggrodemo/jbrain/ConsultaTerceros' endpoint."}], "value": "Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the\u00a0'Facebook' parameter in '/loggrodemo/jbrain/ConsultaTerceros' endpoint."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2026-02-09T11:41:37.382Z"}, "references": [{"tags": ["patch"], "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-loggro-pymes-web-application"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The vulnerabilities have been fixed by Loggro Pymes team in version 1.0.124."}], "value": "The vulnerabilities have been fixed by Loggro Pymes team in version 1.0.124."}], "source": {"discovery": "EXTERNAL"}, "title": "Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T13:02:52.882941Z", "id": "CVE-2026-1960", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T13:04:04.602Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1960", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T13:02:52.882941Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T13:03:04.358Z"}}], "cna": {"title": "Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "David Padilla Alvarado"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Loggro Pymes", "product": "Loggro Pymes", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.124", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The vulnerabilities have been fixed by Loggro Pymes team in version 1.0.124.", "supportingMedia": [{"type": "text/html", "value": "The vulnerabilities have been fixed by Loggro Pymes team in version 1.0.124.", "base64": false}]}], "datePublic": "2026-02-06T11:00:00.000Z", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-loggro-pymes-web-application", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the\u00a0'Facebook' parameter in '/loggrodemo/jbrain/ConsultaTerceros' endpoint.", "supportingMedia": [{"type": "text/html", "value": "Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'Facebook' parameter in '/loggrodemo/jbrain/ConsultaTerceros' endpoint.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:loggro_pymes:loggro_pymes:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.124", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2026-02-09T11:41:37.382Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1960", "state": "PUBLISHED", "dateUpdated": "2026-02-09T13:04:04.602Z", "dateReserved": "2026-02-05T10:40:49.603Z", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "datePublished": "2026-02-09T11:41:37.382Z", "assignerShortName": "INCIBE"}, "dataVersion": "5.2"}