EUVD-2026-91379
GHSA-x7xf-6wjh-6p79
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliverySubmit XSS payload via nomDelegacion to /es/delegations/store
-
ExploitPayload stored in delegation record
-
ExecutionVictim views affected page
-
PersistScript executes in victim browser
-
ImpactSession hijack or actions as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session with sufficient privileges to reach the delegations creation feature and submit the 'nomDelegacion' field to '/es/delegations/store' (PR:L). It additionally requires a victim to actively view the page rendering the injected value (UI:A), making this a stored XSS dependent on a second user's interaction. Limiting factors: the attacker cannot act fully unauthenticated, the payload only executes in the browser of a user who loads the affected delegation data, and impact is confined to the browser/session context rather than the server. |
| Impact | This is a stored/reflected Cross-Site Scripting flaw (CWE-79) in the 'nomDelegacion' parameter of the '/es/delegations/store' endpoint in the Repasat application. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) rates it 4.8 (Medium), and the key signals are consistent: network-reachable but requiring authenticated low privileges (PR:L) and active victim interaction (UI:A), with only limited confidentiality and integrity impact and no availability impact. No EPSS score, KEV listing, or POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'RCE' tag conflicts with the actual vulnerability class - the description's phrase 'execute arbitrary code in the victim's browser' refers to JavaScript execution in the browser context (classic XSS), NOT remote code execution on the server; treating this as RCE would materially overstate the risk. Net: a genuine but modest-priority Medium-severity web flaw, not an urgent high-risk issue. |
| Exploit ScenarioDerived | An authenticated attacker with access to the delegations feature submits a crafted 'nomDelegacion' value containing a malicious script payload to '/es/delegations/store'. When another user (e.g. an administrator) later views the stored delegation name, the script executes in their browser, enabling session/cookie theft or actions performed as the victim. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Stored cross-site scripting in the Repasat application's delegation creation feature allows an authenticated attacker to inject malicious JavaScript into the 'nomDelegacion' parameter, which then executes in the browser of any user who views the affected delegation page. Exploitation requires a low-privileged authenticated session (PR:L) and active user interaction from a victim (UI:A); the attacker cannot act unauthenticated. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS base score is 4.8 (CVSS 4.0).
RemediationAI
No vendor-released patch or fixed version is specified in the available data; refer to the INCIBE advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application) for updates when they become available. Until a patch is applied, implement compensating controls: enforce server-side input validation and context-aware output encoding for the 'nomDelegacion' parameter when rendering delegation data, ensuring HTML entity encoding to neutralize script tags. Deploy a Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted domains, though this may break legitimate inline scripts and requires testing. Restrict access to the delegation creation feature to trusted users only, since the vulnerability requires an authenticated session (PR:L). Enable HttpOnly and Secure flags on session cookies to limit the impact of successful XSS on session theft, understanding that this does not prevent script execution. Monitor delegation content for suspicious payloads. These measures reduce risk but do not fully eliminate the vulnerability; apply the vendor patch as soon as it is released.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-79 Cross-site Scripting (XSS) flaw in the Repasat application, specifically in the 'nomDelegacion' parameter submitted to the '/es/delegations/store' endpoint. This is a stored XSS: an authenticated user with privileges to create delegations can supply a malicious payload that is persisted by the application. When another user (or the same user) later views the delegation data, the payload is rendered without proper output encoding, causing arbitrary JavaScript to execute in the victim's browser context. The endpoint path '/es/delegations/store' suggests a Spanish-language deployment and a form submission handler for creating delegation records. No CPE or exact version information is available, but the INCIBE advisory lists multiple vulnerabilities in the Repasat application, indicating a broader set of issues. The root cause is improper neutralization of user input during web page generation, which could be mitigated by context-aware output encoding and input validation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated low-privilege input (PR:L) with required victim interaction (UI:R); stored script crosses into the victim's browser context (S:C) with limited C/I impact and no availability loss.
Primary rating from Vendor (incibe).
CVSS VectorVendor: incibe
DescriptionCVE.org
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomDelegacion” parameter is affected - endpoint “/es/delegations/store”.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB