EUVD-2026-91383
GHSA-j284-gm2q-8w7h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryInject script via 'nomRuta' at /es/routes/update/693
-
ExploitVictim loads affected route page
-
ExecutionPayload executes in victim browser
-
ImpactSession hijack or actions as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privileged account in the Repasat application (PR:L) capable of submitting the 'nomRuta' parameter to the /es/routes/update/693 route-update endpoint, plus active interaction from a victim user who must load the page rendering the injected payload (UI:A). These two factors - prior authentication and victim interaction - are the primary limiters; a purely anonymous attacker cannot reach the injection point, and no code runs until a victim views the affected content. Impact is confined to the victim's browser session (session/token theft, actions-as-victim), not the server host. |
| Impact | This is a genuinely medium/low-priority issue rather than an urgent one. The CVSS 4.0 base score is 4.8 (Medium), and the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N tells a consistent story: although the attack is network-reachable (AV:N) with low complexity (AC:L), it requires an already-authenticated low-privileged account (PR:L) AND active user interaction from a victim (UI:A), with only limited confidentiality and integrity impact (VC:L/VI:L) and no availability impact. These prerequisites substantially cap real-world risk. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of exploitation activity; the correct posture is to treat this as 'no public exploit identified.' One signal conflict worth flagging: the input Tags include 'RCE', but the description and CWE-79 describe arbitrary code execution strictly within the victim's browser (client-side JavaScript), NOT server/host remote code execution - the 'RCE' tag overstates impact and should be disregarded. |
| Exploit ScenarioDerived | An authenticated low-privileged user injects a malicious script payload into the 'nomRuta' parameter of the /es/routes/update/693 endpoint in the Repasat application. When another user (e.g., an administrator viewing the affected route record) loads the page, the stored/reflected script executes in their browser, potentially stealing session tokens or performing actions as that user. No public exploit code was identified, and successful exploitation depends on luring or waiting for a victim to view the crafted content (UI:A). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Cross-site scripting in the Repasat application lets an authenticated low-privileged user inject script payloads through the 'nomRuta' parameter of the /es/routes/update/693 route-update endpoint, which then execute in the browser of any victim who loads the affected page. Exploitation requires two prerequisites - a valid low-privilege account (CVSS PR:L) and victim interaction with the crafted content (UI:A) - and the resulting impact is confined to the victim's browser session, such as session or token theft and actions performed as the victim, rather than compromise of the server host. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; the issue rates as a medium-to-low priority rather than an urgent one.
RemediationAI
No vendor-released patch has been identified at time of analysis, so remediation must begin with the vendor advisory from INCIBE (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application) to confirm whether a fixed build has since been published and, if so, to upgrade to that exact version once verified rather than relying on any version number not supplied here. Until a fix is available, the most effective compensating control is to apply context-aware output encoding to the 'nomRuta' parameter server-side and validate it against a strict allowlist of expected route-name characters - the trade-off is that overly restrictive validation may reject legitimate non-ASCII or unusually punctuated route names and require tuning. In the interim, restrict access to the /es/routes/update endpoints to the smallest possible set of trusted, high-privilege accounts and treat PR:L exposure as the primary attack enabler, since removing low-privileged write access removes the injection path at the cost of narrowing legitimate workflow permissions. Deploy a Content-Security-Policy with a strict script-src (nonce- or hash-based) and no unsafe-inline to blunt payload execution in victims' browsers, and set session cookies with HttpOnly and SameSite=Lax or Strict so that any script that does run cannot exfiltrate session tokens - these controls reduce impact rather than eliminating the underlying flaw and can break applications that depend on inline scripts. Consider WAF or reverse-proxy filtering of script-bearing input on the affected route as a short-term detection and blocking layer, recognizing that signature-based filtering is bypassable and should not be treated as a fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic output-encoding failure in a web application. Repasat is a route-management application (note the Spanish-language path /es/routes/update/) whose route-update handler at /es/routes/update/693 accepts a 'nomRuta' (route name) parameter and embeds it into the generated HTML response without adequate contextual escaping. Because the parameter is attacker-controllable, a low-privileged user who can reach the update endpoint can supply markup or script that a subsequent visitor's browser renders and executes, violating the same-origin trust of the application. The CPE record cpe:2.3:a:repasat:repasat_application:*:*:*:*:*:*:*:* uses a wildcard for version, indicating that no fixed version is identified and the exposure should be treated as potentially affecting all released builds. Note that the accompanying 'RCE' tag refers only to arbitrary JavaScript execution inside the victim's browser, not to server-side code execution; the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) confirms a browser-scoped scope change with low confidentiality and integrity impact and no availability impact.
Know when Repasat Application gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated low-priv injection (PR:L) needing victim interaction (UI:R); XSS crosses into the victim's browser context (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
DescriptionCVE.org
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomRuta” parameter is affected - endpoint “/es/routes/update/693”.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Repasat Application
View allStored cross-site scripting in the Repasat application allows an authenticated, low-privileged user to inject script con
Stored/reflected cross-site scripting in the Repasat application (CWE-79) lets an attacker with a valid account and carr
Stored cross-site scripting in the Repasat application lets an authenticated user with access to the geozone editing fun
Cross-site scripting in the Repasat application lets an authenticated low-privilege user inject script through the 'nomT
Authenticated cross-site scripting in the Repasat application allows low-privileged users to inject malicious scripts vi
Stored cross-site scripting in the Repasat application allows an authenticated user with low-level privileges to inject
Cross-site scripting in the Repasat application allows an authenticated low-privileged user to inject script that execut
Cross-site scripting in the Repasat application lets an authenticated attacker inject script through the 'nomListaValida
Stored/reflected cross-site scripting in the Repasat application lets an authenticated low-privileged user inject a scri
Stored/reflected cross-site scripting in the Repasat application allows an attacker holding valid low-privilege credenti
Authenticated attackers with low privileges can inject malicious scripts into the Repasat application's '/es/origins/sto
Exploit-DB