CVE-2026-124637 Stored Cross-Site Scripting (XSS) in Tankuam Places
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124637?
CVE-2026-124637 is a medium-severity vulnerability in Kompini Tankuam Places, published on 9 Nov 2026.
Official description
A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a request to https://www.luxorgymtarrega.com/dadespersonals/modificarClient/ID. User-provided data is neither validated nor escaped before being displayed in the HTML response and stored in the database, allowing arbitrary JavaScript code to be executed in the victim’s browser.
Weakness: CWE-79
Which versions are affected by CVE-2026-124637?
How do I fix CVE-2026-124637?
No fix has been published for CVE-2026-124637 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124637 being exploited?
There is no known exploitation of CVE-2026-124637 in the wild and no public exploit code.
Sources
Also known as GHSA-7fqq-gp93-mqjc.