Repasat CVE-2026-59665

Exploitation requires an authenticated low-privilege account on the Repasat application (PR:L) able to submit data to the '/es/lostmotives/store' endpoint via the 'nomMotivo' parameter, plus active interaction from a victim user who must load the page that renders the injected value (UI:A). These two factors - valid authentication and a victim viewing the malicious content - meaningfully limit real-world exploitation; this is not a remote unauthenticated flaw. Impact is confined to the victim's browser context (session/data within the app), with no server-side code execution or availability impact.

This is a genuinely low-to-moderate priority issue despite the CWE-79 classification. The supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) describes a network-reachable but authenticated (PR:L) stored/reflected XSS that requires active victim interaction (UI:A) and yields only limited confidentiality and integrity impact (VC:L/VI:L) with no availability or subsequent-system impact (VA:N/SC:N/SI:N/SA:N), consistent with the 4.8 (Medium) score. No EPSS score, KEV listing, or POC indicator is present in the input, so the correct exploitation status is 'no public exploit identified at time of analysis'; there is no evidence of active exploitation. A notable conflict exists in the metadata: the CVE is tagged 'RCE', but the description explicitly scopes impact to 'arbitrary code in the victim's browser' (i.e., client-side JavaScript via XSS), NOT server-side remote code execution - the RCE tag overstates real risk and should be disregarded. In short, this is a correctly-scored Medium XSS gated by authentication and user interaction, not a high-real-risk flaw; the main uncertainty is whether the XSS is stored or reflected (the '/es/lostmotives/store' endpoint name suggests a persistence/write action, implying stored XSS, but this is not confirmed by the input).

An authenticated attacker with access to the Repasat application submits a malicious JavaScript payload through the 'nomMotivo' parameter at the '/es/lostmotives/store' endpoint. When another authenticated user (e.g., an administrator or colleague) later views the page rendering that 'lost motive' value, the script executes in their browser, enabling session token theft or actions performed as the victim. No public exploit code is identified at time of analysis, and successful exploitation depends on a victim viewing the attacker-supplied content.