EUVD-2026-91328
GHSA-vwp3-mc76-rf8m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitInject XSS payload via getemployeetypesdatatable endpoint
-
ExecutionVictim user loads crafted/affected page
-
ImpactMalicious script executes in victim's browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a valid authenticated low-privileged account on the Repasat application (PR:L), and (2) active victim interaction - a legitimate logged-in user must load the attacker-influenced '/es/datatables/getemployeetypesdatatable' content (UI:A). Impact is limited to the victim's browser context (session token theft, actions-as-victim), with no server-side code execution and no availability impact. The twin prerequisites of prior authentication and tricking a second user materially limit real-world exploitability versus an unauthenticated drive-by. |
| Impact | This is a reflected/stored Cross-Site Scripting flaw (CWE-79) in the Repasat application, scored CVSS 4.0 base 4.8 (Medium). The provided vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) indicates network-reachable, low-complexity exploitation that nonetheless requires an authenticated low-privileged account (PR:L) AND active victim interaction (UI:A), with only Low confidentiality and integrity impact and no availability impact - consistent with script execution confined to the victim's browser session rather than server compromise. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no public exploit identified at time of analysis. The absence of KEV/EPSS plus the dual requirements of authentication and user interaction place this firmly in the low-real-risk tier despite the XSS category; it is a legitimate issue to patch but not an urgent, mass-exploited priority. Note a conflict in the input metadata: the 'RCE' tag overstates impact - the description explicitly scopes code execution to 'the victim's browser,' which is client-side script execution, not server-side remote code execution. Treat the RCE characterization as inaccurate. |
| Exploit ScenarioDerived | An authenticated low-privileged attacker injects a malicious script payload through the '/es/datatables/getemployeetypesdatatable' endpoint and lures another logged-in user into loading the affected page or crafted request. When the victim's browser renders the unsanitized output, the script executes in their session, potentially stealing session tokens or performing actions as the victim. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Cross-site scripting in the Repasat application allows an authenticated low-privileged user to inject script that executes in a second, logged-in victim's browser when they load the affected '/es/datatables/getemployeetypesdatatable' endpoint, enabling session token theft and actions performed as the victim. Exploitation is not a drive-by: it requires a valid low-privileged account (CVSS vector PR:L) plus victim interaction (UI:A), and the impact is confined to the client-side browser context with no server-side code execution and no availability impact. Scored 4.8 (Medium) under CVSS 4.0, the flaw carries no CISA KEV listing and no public exploit code was identified at time of analysis, so treat it as a real but precondition-heavy weakness rather than an imminent mass-exploitation risk.
RemediationAI
No vendor-released patch identified at time of analysis, and the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application is the authoritative reference to monitor for a fixed build or an exact version number. Until a patch is confirmed, apply output encoding on the server side for all fields returned by '/es/datatables/getemployeetypesdatatable' (HTML-entity encode employee-type names in the JSON response, or configure the DataTables render callbacks to use text nodes instead of innerHTML) - this is the highest-fidelity fix but requires source access and regression testing of the table UI. As compensating controls, deploy a Content-Security-Policy that disallows 'unsafe-inline' and restricts script-src to trusted origins, which neutralizes most injected handlers at the cost of possibly breaking legacy inline JavaScript in the application; set session cookies with HttpOnly and SameSite=Strict to blunt token theft via injected script; and consider restricting or temporarily disabling the affected endpoint for non-administrative roles, accepting the loss of that reporting view for low-privileged users. Because exploitation requires both an authenticated low-privileged account and a second user loading the crafted content, tightening account provisioning and monitoring for unusual DataTables requests from low-privileged accounts also reduces exposure. Finally, review the INCIBE advisory for sibling issues disclosed under the same notice, as it describes multiple vulnerabilities in the same product.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically missing or insufficient output encoding of data returned through the application's DataTables server-side processing endpoint. The route '/es/datatables/getemployeetypesdatatable' follows the ASP.NET MVC/WebForms DataTables pattern, where the backend returns JSON rows that the client-side DataTables JavaScript library renders directly into the DOM; when field values (such as employee-type names) are reflected into the table without HTML/attribute encoding, an attacker-controlled string closes the surrounding markup and injects a script or event handler. Because the payload is stored/reflected through an authenticated application route, the attack surface is the browser rendering pipeline rather than the server runtime. The CVE is mapped to CPE cpe:2.3:a:repasat:repasat_application:*:*:*:*:*:*:*:*, indicating all versions of the Repasat application are in scope rather than a single pin-pointed build. A source tag labels the issue 'RCE', but this reflects the generic browser-context 'arbitrary code execution' phrasing; the authoritative assessment confirms no server-side execution, with the CVSS 4.0 vector showing only low confidentiality and integrity impact (VC:L/VI:L) and no availability impact (VA:N).
Know when Repasat Application gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable XSS needing a low-priv account (PR:L) and victim interaction (UI:R); S:C as script executes in another user's browser context, with Low C/I and no availability impact.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
DescriptionCVE.org
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The endpoint “/es/datatables/getemployeetypesdatatable” is affected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Repasat Application
View allStored cross-site scripting in the Repasat application allows an authenticated, low-privileged user to inject script con
Cross-site scripting in the Repasat application lets an authenticated low-privileged user inject script payloads through
Stored/reflected cross-site scripting in the Repasat application (CWE-79) lets an attacker with a valid account and carr
Stored cross-site scripting in the Repasat application lets an authenticated user with access to the geozone editing fun
Cross-site scripting in the Repasat application lets an authenticated low-privilege user inject script through the 'nomT
Authenticated cross-site scripting in the Repasat application allows low-privileged users to inject malicious scripts vi
Stored cross-site scripting in the Repasat application allows an authenticated user with low-level privileges to inject
Cross-site scripting in the Repasat application lets an authenticated attacker inject script through the 'nomListaValida
Stored/reflected cross-site scripting in the Repasat application lets an authenticated low-privileged user inject a scri
Stored/reflected cross-site scripting in the Repasat application allows an attacker holding valid low-privilege credenti
Authenticated attackers with low privileges can inject malicious scripts into the Repasat application's '/es/origins/sto
Exploit-DB