EUVD-2026-91331
GHSA-3rwv-95q4-v6r6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
ExploitInject script via nomGrupoEmpresarial parameter
-
ExecutionVictim loads corporategroups page
-
ImpactPayload executes in victim browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privileged account on the Repasat application (PR:L) with access to the corporate groups update function, plus active interaction from a victim user who must load the page rendering the malicious 'nomGrupoEmpresarial' value at /es/corporategroups/update/246 (UI:A). Exploitation is limited by the authentication requirement, the need for victim interaction, and the client-side-only impact - there is no server compromise or availability effect. This is not exploitable against unauthenticated users or default-only configurations without a valid account. |
| Impact | This is a medium-severity authenticated stored/reflected Cross-Site Scripting flaw (CWE-79) with a CVSS 4.0 base score of 4.8. The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A indicates network reach and low attack complexity, but exploitation requires BOTH a low-privileged authenticated account (PR:L) and active victim interaction (UI:A), which meaningfully constrains real-world risk. Impact is limited to the browser context (VC:L/VI:L, no availability or subsequent-system impact), consistent with XSS rather than server-side code execution. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a data conflict: the input Tags include 'RCE', but the description ('execute arbitrary code in the victim's browser') and CWE-79 describe client-side script execution, NOT remote code execution - the RCE label overstates impact and should be disregarded. Overall this is a genuine but modest-priority issue: a high-CVSS impression from the 'RCE' tag is not supported by the actual CVSS vector or CWE. |
| Exploit ScenarioDerived | An attacker with a valid low-privileged Repasat account submits a malicious script payload via the 'nomGrupoEmpresarial' parameter at the /es/corporategroups/update/246 endpoint. When a victim user (e.g., an administrator viewing the corporate group record) loads the affected page, the injected JavaScript executes in their browser session, potentially stealing session tokens or performing actions as the victim. No public exploit code is identified at this time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Authenticated cross-site scripting in the Repasat application allows low-privileged users to inject malicious scripts via the 'nomGrupoEmpresarial' parameter, which execute in a victim's browser when they view the affected corporate group update page at /es/corporategroups/update/246. Exploitation requires a valid account with access to the corporate groups update function and active interaction from a victim user; the impact is limited to client-side script execution with no server compromise or availability effect. This medium-severity flaw (CVSS 4.0 base score 4.8) has no public exploit code or confirmed active exploitation identified at time of analysis.
RemediationAI
No vendor-released patch has been identified at time of analysis; consult the INCIBE advisory for any updates. As an immediate mitigation, ensure that the 'nomGrupoEmpresarial' parameter is properly validated and output-encoded when rendered in HTML, using context-aware escaping to prevent script injection. Implement a strict Content Security Policy (CSP) to block inline scripts, though this may require careful tuning to avoid breaking legitimate functionality. Restrict access to the corporate groups update function to only trusted users, as the vulnerability requires an authenticated account. Additionally, set session cookies with HttpOnly and Secure flags to reduce the impact of successful XSS. If the corporate groups feature is not essential, consider disabling it. Monitor for vendor patches and apply them as soon as they become available.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-79 improper neutralization of input during web page generation (cross-site scripting) in the Repasat application. The 'nomGrupoEmpresarial' parameter at endpoint /es/corporategroups/update/246 fails to properly sanitize or encode user-supplied input, allowing an attacker to inject arbitrary JavaScript that executes in the context of a victim's browser session. Based on the endpoint and parameter name, this is likely a stored XSS in the corporate group name field, though it could also be reflected if the value is immediately rendered. The CPE string cpe:2.3:a:repasat:repasat_application:*:*:*:*:*:*:*:* indicates the affected product is the Repasat application without a specific version constraint, suggesting all versions may be vulnerable unless patched by the vendor. The tag 'RCE' in the intelligence data refers to client-side code execution, not server-side remote code execution; the independent assessment confirms a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting the need for authentication and user interaction, with scope change due to the browser context.
Know when Repasat Application gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated low-priv injection (PR:L) with required victim interaction (UI:R); stored/reflected XSS crosses into the victim's browser context (S:C) with limited confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
DescriptionCVE.org
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomGrupoEmpresarial” parameter is affected - endpoint "/es/corporategroups/update/246”.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Repasat Application
View allStored cross-site scripting in the Repasat application allows an authenticated, low-privileged user to inject script con
Cross-site scripting in the Repasat application lets an authenticated low-privileged user inject script payloads through
Stored/reflected cross-site scripting in the Repasat application (CWE-79) lets an attacker with a valid account and carr
Stored cross-site scripting in the Repasat application lets an authenticated user with access to the geozone editing fun
Cross-site scripting in the Repasat application lets an authenticated low-privilege user inject script through the 'nomT
Stored cross-site scripting in the Repasat application allows an authenticated user with low-level privileges to inject
Cross-site scripting in the Repasat application allows an authenticated low-privileged user to inject script that execut
Cross-site scripting in the Repasat application lets an authenticated attacker inject script through the 'nomListaValida
Stored/reflected cross-site scripting in the Repasat application lets an authenticated low-privileged user inject a scri
Stored/reflected cross-site scripting in the Repasat application allows an attacker holding valid low-privilege credenti
Authenticated attackers with low privileges can inject malicious scripts into the Repasat application's '/es/origins/sto
Exploit-DB