EUVD-2026-91319
GHSA-qq5x-j93v-98rw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliveryInject script via 'name' parameter on /es/attachmenttypes/update endpoint
-
ExploitVictim loads affected attachment-type page
-
ExecutionPayload executes in victim browser
-
ImpactSteal session or act as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session with at least low-level privileges (PR:L) sufficient to submit the 'name' parameter to the /es/attachmenttypes/update/{id} endpoint, AND active interaction from a victim user who must load the page rendering the injected payload (UI:A). It affects all Repasat application versions prior to the 'Abril' patch (build 20260402). Limiting factors: no anonymous/unauthenticated path, the dependency on victim interaction, and impact confined to the browser context (no server compromise), which materially reduce real-world risk below the raw network-vector reading. |
| Impact | This is a low-to-moderate priority issue, not a top-tier threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) scores 4.8 (Medium) and reflects the realistic profile of a stored/reflected XSS: network-reachable and low-complexity, but gated by two meaningful constraints - the attacker must already hold low-level authenticated access (PR:L) and a victim must actively interact (UI:A) by visiting the affected page. Impact is limited to low confidentiality and low integrity in the browser context, with no availability impact. No EPSS score, CISA KEV listing, or POC was provided, so there is no evidence of active or imminent exploitation. Signals are internally consistent (all point to a modest, interaction-and-auth-dependent web flaw) with one exception: the 'RCE' tag conflicts with the actual CWE-79 / XSS classification - the description's 'execute arbitrary code' refers to script execution in the victim's browser, NOT server-side remote code execution, so the RCE framing overstates the impact. Treat this as a standard authenticated web XSS to remediate on a normal patch cycle rather than an emergency. |
| Exploit ScenarioDerived | An attacker with a low-privileged authenticated account in the Repasat application submits a malicious script payload via the 'name' parameter of the /es/attachmenttypes/update/203336 endpoint. When a victim user (e.g., an administrator or another operator) subsequently views the affected attachment-type page, the stored/reflected script executes in their browser, enabling session token theft or actions performed as the victim. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Stored cross-site scripting in the Repasat application allows an authenticated user with low-level privileges to inject arbitrary script through the 'name' parameter of the /es/attachmenttypes/update/{id} endpoint, which then executes in the browser of any user who renders the affected attachment-type record. The INCIBE advisory (EUVD-2026-91319) scores it 4.8 under CVSS 4.0; our independent review maps it to CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, i.e. an authenticated, interaction-dependent issue whose impact stays inside the victim's browser and does not extend to server compromise. No public exploit identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so this is a low-to-moderate priority issue rather than a top-tier threat, affecting all Repasat versions prior to the 'Abril' patch (build 20260402).
RemediationAI
Apply the vendor's 'Abril' patch (build 20260402), which is the version threshold indicated in the advisory's affected range ('0 < Abril patch 20260402') and therefore the primary fix for this issue; confirm the exact artifact with the vendor via the INCIBE-CERT notice at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application before rolling out. If the patch cannot be deployed immediately, the most effective compensating control is to restrict access to the attachment-types update functionality (/es/attachmenttypes/update/{id}) to the smallest possible set of trusted roles, since exploitation already requires an authenticated low-privilege session - the trade-off is that legitimate administrators lose the ability to maintain attachment types until the patch lands. In parallel, ensure the 'name' parameter is output-encoded whenever attachment-type records are rendered (HTML entity encoding on display) and add a Content-Security-Policy that disallows inline and third-party script on the affected views; a strict CSP can break legitimate front-end functionality and requires testing, so stage it. Where a web application firewall or reverse proxy is in place, add rules to reject script-bearing payloads and angle brackets in the attachment-type name field, understanding that signature-based filtering is bypassable and is a stopgap only. Finally, because the script executes in the victim's browser, treat any pre-patch administrator session as potentially exposed: review audit logs for unexpected changes to attachment types and force re-authentication of privileged users after remediation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79, improper neutralization of user-controlled input during web page generation. The 'name' field accepted by the attachment-types update handler is persisted and subsequently rendered back into HTML without adequate output encoding, turning a write operation into a stored (persistent) script-injection primitive. The localized path /es/attachmenttypes/update/{id} indicates the vulnerable functionality lives in the Spanish-language deployment of the application's attachment-type administration module, where each record is identified by a numeric id and re-displayed in list/detail views - the rendering step is what triggers execution, which is why the assessed vector carries UI:R and the EUVD/4.0 vector carries UI:A. The scope-change component (S:C) reflects that the injected script runs with the origin and session context of the victim's browser, potentially riding an authenticated session to act on attachment-type management functions; however, the confidentiality and integrity impacts are rated Low and availability is None (VC:L/VI:L/VA:N), which bounds the effect to the client tier. Note that the 'RCE' tag in the source intelligence feed should be read as arbitrary code execution inside the victim's browser, not remote code execution on the server - the absence of any availability impact or server-side integrity impact in the assessed vector supports that reading, and no remote-code-execution primitive is described in the advisory. The CPE cpe:2.3:a:repasat:repasat_application:*:*:*:*:*:*:*:* uses a wildcard version range, consistent with the advisory's statement that the entire product line below the 'Abril' patch is affected rather than a single release.
Know when Repasat Application gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated low-priv input (PR:L) and required victim interaction (UI:R); scope changes to the victim browser (S:C) with low C/I and no availability impact, consistent with reflected/stored XSS.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
DescriptionCVE.org
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “name” parameter is affected - endpoint “/es/attachmenttypes/update/203336”
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Repasat Application
View allStored cross-site scripting in the Repasat application allows an authenticated, low-privileged user to inject script con
Cross-site scripting in the Repasat application lets an authenticated low-privileged user inject script payloads through
Stored/reflected cross-site scripting in the Repasat application (CWE-79) lets an attacker with a valid account and carr
Stored cross-site scripting in the Repasat application lets an authenticated user with access to the geozone editing fun
Cross-site scripting in the Repasat application lets an authenticated low-privilege user inject script through the 'nomT
Authenticated cross-site scripting in the Repasat application allows low-privileged users to inject malicious scripts vi
Cross-site scripting in the Repasat application allows an authenticated low-privileged user to inject script that execut
Cross-site scripting in the Repasat application lets an authenticated attacker inject script through the 'nomListaValida
Stored/reflected cross-site scripting in the Repasat application lets an authenticated low-privileged user inject a scri
Stored/reflected cross-site scripting in the Repasat application allows an attacker holding valid low-privilege credenti
Authenticated attackers with low privileges can inject malicious scripts into the Repasat application's '/es/origins/sto
Exploit-DB