CVE-2026-79419 is a high severity (CVSS 8.7) reflected cross site scripting flaw in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The mensagem parameter of the Configuracao Imagens page is not validated or sanitized. We could not confirm a fixed version, so check with the vendor.
What's affected
- EMX Tecnologia Gestao X Business Suite 8.4 and earlier, per the CVE record.
- The weak spot is the mensagem parameter of the /Configuracao/Imagens.aspx endpoint.
- Fixed version: not confirmed. The record references a shared document and the vendor home page, and neither gave a version. Ask the vendor.
Record severity: CVSS 8.7 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. The weakness class is CWE-79, Improper Neutralization of Input During Web Page Generation.
How to check if you're exposed
Check the installed version in the application. If it is 8.4 or earlier, assume it is affected. Review web server logs for requests to the Imagens page with unusually long or encoded values in the mensagem parameter, and consider a web application firewall rule for that parameter.
What to do now
- Confirm the Gestao X version.
- Ask EMX Tecnologia for the fixed release and apply it.
- Add a filter rule for the mensagem parameter at your proxy or firewall in the meantime.
- Tell users with access to the configuration pages not to follow links to them from email or chat.
- Set a strict content security policy where the application allows it.
Why it matters
Reflected cross site scripting (CWE-79) echoes part of a request back in the response without neutralizing it. An attacker usually gets a victim to open a crafted link. The script then runs as that user, which is serious when the user is an administrator.
The record says the attacker is authenticated, and the score is 8.7 with changed scope. Because the page is a configuration screen, administrators are the likely targets. The record does not mark this as exploited in the wild.
Quick check
What differs from CVE-2026-79418?
This one is reflected through a URL parameter, while 79418 is stored in the Help Chat.
Is a fix confirmed?
No. Contact the vendor.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
