Vulnerability · Published Mar 16, 2026 · Assigned by INCIBE
CVE-2026-3024Stored Cross-Site Scripting (XSS) vulnerability in the Wakyma application web
Medium 4.8
In plain English
A medium-severity cross-site scripting in Wakyma application web from Wakyma. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
Stored Cross-Site Scripting (XSS) vulnerability in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/configuracion/agenda/modelo-formulario-evento'. A user with permission to create personalized accounts could exploit this vulnerability simply by creating a malicious survey that would harm the entire veterinary team. At the same time, a user with low privileges could exploit this vulnerability to access unauthorized data and perform actions with elevated privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Wakyma | Wakyma application web | all versions |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N