Repasat Application CVE-2026-59673

Exploitation requires an authenticated low-privilege account (PR:L) on the Repasat application to inject a payload into the 'nomTipoCli' parameter of the /es/clientypes/update/109441 endpoint, and additionally requires a victim user to actively view or interact with the affected client-type content (UI:A) for the script to execute. Limiting factors: the attacker cannot act fully unauthenticated, the payload only fires in a victim's browser session rather than against the server, and impact is confined to that browser context (no availability impact, same-system scope). Any Repasat build below the 'Abril' patch (20260402) is affected.

This is a stored/reflected Cross-Site Scripting flaw (CWE-79) with a CVSS 4.0 base score of 4.8 (Medium). The vendor-supplied vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N shows network reachability and low attack complexity, but two factors materially reduce real-world risk: PR:L means the attacker must already hold a low-privilege authenticated account, and UI:A (equivalent to UI:R) means a victim must actively interact with the malicious content for the payload to fire. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no public exploit identified at time of analysis. The impact is limited to VC:L/VI:L (low confidentiality and integrity, no availability impact) and the scope stays on the same system (SC:N/SI:N/SA:N), consistent with a browser-context script execution rather than server compromise. Net assessment: a genuine but low-to-moderate priority issue - authentication plus required user interaction keep it well below a drop-everything emergency, and the 'RCE' tag in the input is misleading (see data_quality_flags) because the description explicitly scopes execution to 'the victim's browser,' i.e. client-side script, not server remote code execution.

An authenticated low-privilege user submits a crafted payload in the 'nomTipoCli' parameter at the endpoint /es/clientypes/update/109441, which is stored/reflected without proper output encoding. When another user (potentially a higher-privileged administrator) views the affected client-type page, the injected JavaScript executes in their browser session, enabling session token theft or actions in their security context. No public exploit code is identified at time of analysis, and successful exploitation requires the victim to view the poisoned content.