EUVD-2026-91368
GHSA-6hjq-f8x2-6wjp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliveryInject script via nomTamano parameter
-
ExploitPayload stored/reflected at /es/companysizemployees/update
-
ExecutionVictim loads affected page
-
PersistArbitrary JavaScript executes in victim browser
-
ImpactSession hijack or actions as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session (CVSS PR:L) to reach and submit the 'nomTamano' parameter at the '/es/companysizemployees/update' endpoint of the Repasat application, plus active interaction by a victim user (UI:A) who must load the page rendering the injected payload. Limiting factors: the attacker needs valid low-privilege credentials, a separate victim must view the malicious content, and impact is confined to the victim's browser context (no server-side code execution and no scope change, SC:N/SI:N/SA:N). |
| Impact | This is a moderate-severity stored/reflected Cross-Site Scripting flaw (CWE-79) carrying a vendor/INCIBE CVSS 4.0 base score of 4.8 (Medium). The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A indicates network-reachable, low-complexity exploitation but requires at least low-level authenticated privileges (PR:L) AND active user interaction (UI:A), both of which meaningfully lower real-world risk. Impact is bounded: VC:L/VI:L/VA:N with no scope change to subsequent systems (SC:N/SI:N/SA:N), consistent with script execution confined to the victim's browser session rather than server compromise. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a signal conflict: the input Tags include 'RCE', but the description explicitly scopes impact to 'arbitrary code in the victim's browser' - this is browser-side script execution (XSS), NOT server-side remote code execution; the RCE tag appears mislabeled and should not drive prioritization. Overall this is a genuine but low-to-moderate priority issue typical of authenticated XSS in a niche business application, not a high-urgency widespread threat. |
| Exploit ScenarioDerived | An authenticated attacker with low-privilege access submits a crafted payload in the 'nomTamano' parameter of the /es/companysizemployees/update endpoint, storing or reflecting malicious JavaScript. When another authenticated user (e.g., an administrator) views the affected page, the script executes in their browser, enabling session token theft or actions performed as that user. No public exploit code is identified at time of analysis, and the attack requires both valid credentials (PR:L) and victim interaction (UI:A). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Stored/reflected cross-site scripting in the Repasat application allows an attacker holding valid low-privilege credentials to inject arbitrary script through the 'nomTamano' parameter at the '/es/companysizemployees/update' endpoint, which then executes in the browser of a user who loads the affected page. The flaw is rated 4.8 (Medium) by the vendor/INCIBE under CVSS 4.0 and requires an authenticated session (CVSS PR:L) plus active victim interaction (UI:A); there is no public exploit identified at time of analysis and the CVE is not reported as confirmed actively exploited (CISA KEV). Impact is confined to the victim's browser context - no server-side code execution, no loss of confidentiality or integrity at the server, and no availability impact.
RemediationAI
No exact fixed version is identified in the available data, so there is no confirmed version string to upgrade to; administrators should consult the INCIBE advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application) and the vendor's own channel to obtain the patched build and the affected-version list, and note that patch availability is not independently confirmed here. Until a fix is applied, the most effective compensating controls are: enforce server-side, context-aware output encoding of the 'nomTamano' parameter (and of all user-supplied fields rendered back into HTML) so injected markup is displayed rather than executed - this requires code-level changes and carries regression risk in the company-size/employees screens; deploy a Content-Security-Policy that disallows inline and third-party script on the Repasat application so injected script fails to run, accepting that a strict CSP can break legitimate front-end behavior and must be tuned; mark session cookies HttpOnly and SameSite so any successfully executed script cannot trivially exfiltrate authenticated sessions, though this does not prevent DOM-based abuse of the current page; restrict access to the '/es/companysizemployees/update' endpoint to the minimum set of trusted, authenticated roles and require re-authentication for privileged updates, which reduces the pool of potential injectors at the cost of some usability; and add a WAF rule to flag script-bearing input on 'nomTamano' and the companysizemployees update path as a temporary detection/blocking layer, recognizing that WAF signatures are bypassable and are not a substitute for the encoding fix. Because exploitation additionally depends on a victim loading the poisoned page, user awareness and preventing untrusted users from gaining any Repasat account further reduce exposure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-79 improper neutralization of input during web page generation (cross-site scripting) issue in a vendor-specific web application, Repasat, tracked by CPE cpe:2.3:a:repasat:repasat_application:*:*:*:*:*:*:*:* with a wildcard version, indicating the affected version range is not pinned by the CPE and is defined by the INCIBE advisory rather than a single release. The vulnerable data path is a localized update route, '/es/companysizemployees/update' (Spanish-language company-size/employees management module), where the 'nomTamano' parameter is written into the response without adequate context-aware output encoding, so attacker-supplied markup is interpreted by the browser. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N) aligns with the independent 3.1 assessment: network-reachable, low attack complexity, authenticated low-privilege prerequisite, active user interaction, and low confidentiality/integrity impact limited to the victim's session - the sub-sequent metrics confirm no impact beyond the vulnerable component, i.e. no server compromise. Note also that the source tag set pairs 'XSS' with 'RCE'; the authoritative assessment does not support server-side remote code execution, and 'RCE' there should be read only as script execution inside the victim's browser, not as code execution on the Repasat server. The likely attack surface requires low-privilege authentication to submit the parameter, and a distinct victim user must then view the rendered page, making this a credential-and-interaction-gated XSS rather than an unauthenticated injection.
Know when Repasat Application gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated (PR:L) and victim interaction (UI:R) are required; XSS crosses a trust boundary into the victim's browser so S:C, with limited confidentiality/integrity impact and no availability loss.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
DescriptionCVE.org
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected - endpoint “/es/companysizemployees/update”.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Repasat Application
View allStored cross-site scripting in the Repasat application allows an authenticated, low-privileged user to inject script con
Cross-site scripting in the Repasat application lets an authenticated low-privileged user inject script payloads through
Stored/reflected cross-site scripting in the Repasat application (CWE-79) lets an attacker with a valid account and carr
Stored cross-site scripting in the Repasat application lets an authenticated user with access to the geozone editing fun
Cross-site scripting in the Repasat application lets an authenticated low-privilege user inject script through the 'nomT
Authenticated cross-site scripting in the Repasat application allows low-privileged users to inject malicious scripts vi
Stored cross-site scripting in the Repasat application allows an authenticated user with low-level privileges to inject
Cross-site scripting in the Repasat application allows an authenticated low-privileged user to inject script that execut
Cross-site scripting in the Repasat application lets an authenticated attacker inject script through the 'nomListaValida
Stored/reflected cross-site scripting in the Repasat application lets an authenticated low-privileged user inject a scri
Authenticated attackers with low privileges can inject malicious scripts into the Repasat application's '/es/origins/sto
Exploit-DB