EUVD-2026-91325
GHSA-2r4w-823m-crf4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged authenticated session
-
DeliveryCraft malicious nomListaValidacion payload
-
ExploitLure victim to assignList endpoint
-
ExecutionScript executes in victim browser
-
ImpactHijack session / act as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a valid authenticated session to the Repasat application (CVSS PR:L) and (2) active victim interaction (UI:A) with attacker-controlled content, targeting the 'nomListaValidacion' parameter at the endpoint /es/validationslists/assignList/Employee/45659. The attacker must be able to deliver or persist the crafted payload and get a logged-in user to render/submit it; there is no path to unauthenticated or non-interactive exploitation. These limiting factors - mandatory authentication plus required user interaction - substantially reduce realistic risk below raw network-reachability. |
| Impact | This is a medium-severity (CVSS 4.0 base 4.8) stored/reflected Cross-Site Scripting flaw (CWE-79) whose real-world risk is modest. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) tells a consistent story: the endpoint is network-reachable and easy to trigger, but exploitation requires an authenticated session (PR:L) AND active victim interaction (UI:A), and impact is limited to low confidentiality/integrity within the browser context. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit code was referenced - so the exploitation status is: no public exploit identified at time of analysis. There is no signal conflict between the vector and the description; both point to a classic authenticated XSS requiring a tricked user. One metadata discrepancy: the input carries an 'RCE' tag, but the description explicitly scopes code execution to 'the victim's browser,' which is XSS, not server-side remote code execution - the RCE tag overstates impact and should not drive prioritization. Overall this is a legitimately-cataloged but lower-tier issue, not an emergency: the limiting factors (authentication plus user interaction plus a niche product footprint) place it well below internet-facing unauthenticated RCE-class priorities. |
| Exploit ScenarioDerived | An authenticated attacker (or an attacker who can influence an authenticated user) crafts a malicious value for the 'nomListaValidacion' parameter on /es/validationslists/assignList/Employee/45659, so that when a victim with an active session loads or is lured into submitting the affected page, injected script runs in their browser. This enables session-context actions such as stealing tokens or performing requests as the victim. No public proof-of-concept was provided, and exploitation depends on the victim actively interacting with the crafted content (UI:A). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Cross-site scripting in the Repasat application lets an authenticated attacker inject script through the 'nomListaValidacion' parameter processed by the /es/validationslists/assignList/Employee/45659 endpoint, so that a logged-in victim who renders or submits the crafted content executes arbitrary JavaScript in their own browser session. Affected deployments are those exposing the Repasat web application and its validation-list assignment functionality, tracked generically by the CPE cpe:2.3:a:repasat:repasat_application (all versions, no version range published). Exploitation is not unauthenticated and not non-interactive: it requires a valid session plus victim interaction, and the independent assessment rates this as medium severity (CVSS 4.0 base 4.8; CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and the flaw has not been confirmed actively exploited (CISA KEV).
RemediationAI
Vendor-released patch: not confirmed - no fixed version is published in the available data and the CPE version field remains a wildcard, so no vendor-released patch identified at time of analysis; the primary remediation path is to check the INCIBE-CERT advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application) and obtain the vendor's fixed release or mitigation guidance, then upgrade as soon as a patched build is confirmed. Where no fix can be applied yet, treat this as an authenticated, interaction-dependent XSS and apply targeted compensating controls rather than generic hardening: enforce context-aware output encoding and input validation/allow-listing on the 'nomListaValidacion' parameter server-side (kills the bug class but requires code ownership and regression testing of the assignment workflow); deploy a Content-Security-Policy that disallows inline and untrusted script sources on the Repasat origin (blocks payload execution, but must be tuned or it will break legitimate inline front-end code); restrict access to /es/validationslists/assignList/* to the specific roles that genuinely need validation-list administration and layer CSRF protections on the route (reduces attacker reach and spoofing, at the cost of administrative convenience); and mark session cookies HttpOnly/SameSite and rotate session identifiers on privilege change to limit the payoff of successful script execution (does not prevent the XSS itself). Monitor for payloads submitted toward the assignList endpoints, and treat any observed injected content as a potential credential/session compromise requiring user notification and token rotation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79, improper neutralization of user-supplied input during web page generation. The Repasat application accepts the 'nomListaValidacion' parameter on the validation-list assignment route (/es/validationslists/assignList/Employee/45659, where 45659 is a concrete employee identifier) and reflects or persists it into the resulting HTML without adequate contextual output encoding, allowing script markup to be delivered to a victim's browser. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) confirms network reachability with low attack complexity but low privileges required and active user interaction, with only low confidentiality and integrity impact confined to the vulnerable component and no availability impact; the independent CVSS 3.1 assessment reaches the same conclusion (PR:L, UI:R) while scoring the impact as scope-changed (S:C) because executed script runs in the victim's authenticated browser context. The supplied tag 'RCE' should not be taken literally: the described outcome is script execution inside the victim's browser session, not server-side remote code execution, so the practical ceiling of this flaw is session-hijacking, credential/CSRF-token theft, or data manipulation performed as the victim. No affected version boundaries are published - the CPE uses an open version wildcard across the Repasat application.
Know when Repasat Application gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable (AV:N) authenticated endpoint (PR:L) requiring victim interaction (UI:R); reflected/stored XSS crosses into the browser context (S:C) with low C/I and no availability impact.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
DescriptionCVE.org
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomListaValidacion” parameter is affected - endpoint “/es/validationslists/assignList/Employee/45659”.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Repasat Application
View allStored cross-site scripting in the Repasat application allows an authenticated, low-privileged user to inject script con
Cross-site scripting in the Repasat application lets an authenticated low-privileged user inject script payloads through
Stored/reflected cross-site scripting in the Repasat application (CWE-79) lets an attacker with a valid account and carr
Stored cross-site scripting in the Repasat application lets an authenticated user with access to the geozone editing fun
Cross-site scripting in the Repasat application lets an authenticated low-privilege user inject script through the 'nomT
Authenticated cross-site scripting in the Repasat application allows low-privileged users to inject malicious scripts vi
Stored cross-site scripting in the Repasat application allows an authenticated user with low-level privileges to inject
Cross-site scripting in the Repasat application allows an authenticated low-privileged user to inject script that execut
Stored/reflected cross-site scripting in the Repasat application lets an authenticated low-privileged user inject a scri
Stored/reflected cross-site scripting in the Repasat application allows an attacker holding valid low-privilege credenti
Authenticated attackers with low privileges can inject malicious scripts into the Repasat application's '/es/origins/sto
Exploit-DB