Repasat Application CVE-2026-59666

Exploitation requires an authenticated account with at least low privileges (CVSS PR:L) able to reach the '/es/origins/store' endpoint and submit data via the 'nomOrigen' parameter, plus active interaction from a victim user (CVSS UI:A) who must load the page rendering the injected payload. These two factors - the authentication requirement and the dependency on a victim viewing the malicious content - are the primary limiters on real-world exploitability; the flaw cannot be triggered against an unauthenticated attack surface or without a victim being lured to the affected view.

This is a stored/reflected Cross-Site Scripting flaw (CWE-79) in the Repasat application, rated CVSS 4.0 4.8 (Medium) by INCIBE. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) indicates network-reachable, low-complexity exploitation that nevertheless requires an authenticated low-privileged account (PR:L) AND active victim interaction (UI:A), with only Low confidentiality/integrity impact and no availability impact - consistent with a browser-context script-execution bug rather than server compromise. No EPSS score, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified; per the precision rules, there is no public exploit identified at time of analysis and no evidence of active exploitation. The combined need for authentication, user interaction, and only Low impacts makes this a genuinely moderate, not critical, priority. One data conflict must be flagged explicitly: the input Tags include 'RCE' and the description phrase 'executing arbitrary code in the victim's browser,' but this is client-side JavaScript execution within the victim's browser context - NOT server-side remote code execution; treating it as RCE would overstate the risk.

An authenticated low-privileged user submits a malicious payload in the 'nomOrigen' parameter at the '/es/origins/store' endpoint; the application stores or reflects it without sanitization. When a victim user (potentially a higher-privileged operator) views the affected page, the injected script executes in their browser, enabling session/token theft or actions performed as the victim. No public exploit code was identified in the provided data.