EUVD-2026-91381
GHSA-p8mc-j3m4-wxm3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliverySubmit payload in nomCompetidor at /es/competitors/store
-
ExploitStore malicious script in competitor record
-
ExecutionVictim views affected page
-
PersistScript executes in victim browser
-
ImpactHijack session or act as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privileged account (PR:L) with access to the competitor-creation feature at the '/es/competitors/store' endpoint, where the attacker injects a script into the 'nomCompetidor' parameter. Successful exploitation is gated on victim interaction (UI:A): a second user must view the page rendering the stored value for the payload to execute. Limiting factors are therefore the need for valid credentials and a victim who opens the affected view; impact is confined to the victim's browser context with no direct server compromise. |
| Impact | This is a genuine but low-to-moderate priority issue, not a top-tier emergency. The CVSS 4.0 base score is 4.8 (Medium), and the vector tells a consistent story: AV:N (network reachable) but PR:L (attacker must already hold a low-privileged authenticated account) and UI:A (a victim must actively interact, i.e. view the attacker-planted content). Impact is bounded - VC:L/VI:L and VA:N - reflecting that a Cross-Site Scripting flaw compromises the victim's browser session, not the server. There is no CISA KEV listing, no EPSS score supplied, no SSVC decision data, and no public proof-of-concept referenced, so there is no evidence of active or imminent exploitation; this is no public exploit identified at time of analysis. The combined requirement of valid authentication plus victim interaction meaningfully lowers real-world risk versus the raw 'network' vector. One data caveat: the input Tags assert 'RCE', but both the CWE (CWE-79) and the description ('execute arbitrary code in the victim's browser') describe browser-side script execution, NOT server-side remote code execution - treat the RCE label as incorrect. |
| Exploit ScenarioDerived | An authenticated low-privilege user submits a competitor record through the /es/competitors/store endpoint, injecting a malicious script into the 'nomCompetidor' parameter. When another user (such as an administrator) later views the stored competitor data, the script executes in their browser, enabling session hijacking or actions performed as that victim. No public proof-of-concept is referenced, and exploitation requires the victim to actively view the poisoned content (UI:A). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Stored cross-site scripting in the Repasat application allows an authenticated, low-privileged user to inject script content through the 'nomCompetidor' parameter processed at the '/es/competitors/store' endpoint, where the value is persisted and later rendered to other users. Payload execution happens in the victim's browser session once that page is viewed, yielding limited confidentiality and integrity impact confined to the browser context with no direct server compromise; successful exploitation requires both a valid low-privileged account (CVSS vector PR:L) and victim interaction (UI:A/UI:R). No public exploit code has been identified at time of analysis, and no vendor-released patch is documented in the available intelligence, making this a genuine but low-to-moderate priority issue rather than an emergency; the primary reference is the INCIBE advisory covering multiple Repasat application vulnerabilities.
RemediationAI
No vendor-released patch is identified in the available data, so remediation must currently rely on compensating controls until INCIBE or the vendor publishes a fixed build; track https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application for updates. The most effective compensating control is server-side contextual output encoding of the 'nomCompetidor' value at render time (HTML-entity encoding, or preferably a templating engine that auto-escapes by default), combined with strict server-side input validation and normalization of that field - the trade-off is that aggressive validation can reject legitimate competitor names containing accented or special characters, so allow-list the expected character set rather than stripping broadly. Deploying a restrictive Content-Security-Policy (e.g., script-src 'self' with nonces and no 'unsafe-inline') will neutralize most injected inline payloads, though it requires auditing existing inline scripts and can break third-party widgets. Set session cookies with HttpOnly and SameSite=Lax/Strict to limit the practical payoff of any successful injection (session token theft), accepting that older applications relying on JavaScript cookie access may need refactoring. As an interim containment measure, restrict access to the competitor-creation feature to a tightly controlled set of trusted roles and review or purge previously stored competitor records for injected markup, since existing persisted payloads will continue to fire until the rendering path is fixed and the stored data is cleaned. Because exploitation requires a valid low-privileged account, monitoring and alerting on anomalous 'nomCompetidor' values, unexpected script-like strings in competitor records, and unusual outbound requests from user browsers provides useful detection coverage while the code fix is pending.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-79 improper neutralization of user input during web page generation, specifically within the competitor-management functionality of the Repasat application. The affected parameter 'nomCompetidor' is submitted to the '/es/competitors/store' route, which implies the value is persisted server-side and subsequently emitted into HTML for other users - the pattern that turns a reflected-style defect into a stored XSS condition. Because the input is not correctly encoded for the HTML output context, an attacker-supplied value can break out of its data context and be interpreted as markup or script by the victim's browser. The CPE string cpe:2.3:a:repasat:repasat_application:*:*:*:*:*:*:*:* uses a wildcard version, indicating that no specific fixed release is enumerated in the source data and that all versions of the application should be treated as potentially affected. The reported CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N) and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) agree on network reachability, low attack complexity, and a low-privileged authenticated attacker; the 3.1 scope-changed metric reflects that the malicious script runs in the victim user's session and can act on that user's behalf within the application's origin, even though the vulnerable component itself is not directly compromised. It is worth noting that the source tagging includes 'RCE' alongside 'XSS'; this is a conflation - arbitrary JavaScript execution in a victim's browser is not remote code execution on the server, and no evidence in the supplied data supports server-side code execution, memory corruption, or authentication bypass.
Know when Repasat Application gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated submitter (PR:L) and victim interaction (UI:R) are required; stored XSS crosses into the victim's browser context (S:C) with limited C/I impact and no availability effect.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
DescriptionCVE.org
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected - endpoint “/es/competitors/store”.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Repasat Application
View allCross-site scripting in the Repasat application lets an authenticated low-privileged user inject script payloads through
Stored/reflected cross-site scripting in the Repasat application (CWE-79) lets an attacker with a valid account and carr
Stored cross-site scripting in the Repasat application lets an authenticated user with access to the geozone editing fun
Cross-site scripting in the Repasat application lets an authenticated low-privilege user inject script through the 'nomT
Authenticated cross-site scripting in the Repasat application allows low-privileged users to inject malicious scripts vi
Stored cross-site scripting in the Repasat application allows an authenticated user with low-level privileges to inject
Cross-site scripting in the Repasat application allows an authenticated low-privileged user to inject script that execut
Cross-site scripting in the Repasat application lets an authenticated attacker inject script through the 'nomListaValida
Stored/reflected cross-site scripting in the Repasat application lets an authenticated low-privileged user inject a scri
Stored/reflected cross-site scripting in the Repasat application allows an attacker holding valid low-privilege credenti
Authenticated attackers with low privileges can inject malicious scripts into the Repasat application's '/es/origins/sto
Exploit-DB