EUVD-2026-91360
GHSA-cppv-rjx4-2j35
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliveryInject script via nomCompetidor at /es/competitors/store
-
ExploitVictim loads affected page
-
ExecutionScript runs in victim browser
-
ImpactSteal session or act as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker with at least low-privilege authenticated access (PR:L) to the Repasat application to submit a crafted payload in the 'nomCompetidor' parameter at the '/es/competitors/store' endpoint, and requires a separate victim to actively view the stored/reflected content (UI:A) for the injected script to execute. Limiting factors: the need for valid credentials, the dependency on victim interaction with the affected view, and impact confined to the victim's browser session rather than the server or host. |
| Impact | This is a medium-severity stored/reflected Cross-Site Scripting flaw (CWE-79) with a vendor/NVD CVSS 4.0 base score of 4.8. The vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) tells a consistent story: network-reachable and low-complexity, but it requires at least low-level authentication (PR:L) to inject the payload via the 'nomCompetidor' parameter and requires active victim interaction (UI:A) for the payload to fire, with only low confidentiality and integrity impact and no availability impact. No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals that would elevate this (KEV/EPSS/POC) are all absent. The input Tags include 'RCE', but this conflicts with the description and CWE: the vulnerability permits 'arbitrary code in the victim's browser' (i.e., JavaScript in the browser context), NOT operating-system remote code execution; treat the RCE tag as mislabeled and do not prioritize this as an RCE. Net: a real but modest-priority issue - an authenticated, interaction-dependent XSS in a niche application - not a high-urgency item. |
| Exploit ScenarioDerived | An authenticated low-privilege user submits a competitor record at /es/competitors/store with a malicious script in the 'nomCompetidor' field; when another user (e.g., an administrator) views that stored value, the script executes in their browser session. No POC was provided, and exploitation depends on a victim opening the affected view, limiting reliability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Cross-site scripting in the Repasat application lets an attacker with at least low-privilege authenticated access inject a crafted payload into the 'nomCompetidor' parameter of the '/es/competitors/store' endpoint, causing arbitrary script to run in a victim's browser when the affected content is viewed. The vendor/NVD CVSS 4.0 base score is 4.8 and our independent assessment rates it medium severity (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires valid credentials plus a separate victim interaction and that impact is confined to the victim's browser session rather than the server or host. No public exploit code or confirmed in-the-wild exploitation has been identified (not listed in CISA KEV), though the supplied tags include an 'RCE' label that the description and assessment do not substantiate - this is an XSS issue, not demonstrated remote code execution.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must begin with the INCIBE-CERT advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application), which should be monitored for an updated Repasat release and applied as soon as a fixed version is published. Until then, apply server-side input validation and output encoding for the 'nomCompetidor' parameter, rejecting or escaping HTML metacharacters on write and HTML-encoding on render, which is the definitive fix for this class of flaw and carries negligible functional trade-off. Restrict access to the '/es/competitors/store' endpoint to the smallest possible set of trusted, authenticated roles, since exploitation requires a low-privilege account; be aware this reduces the attack surface but does not eliminate risk if any legitimate user account is compromised. Deploy a Content-Security-Policy that disallows inline and untrusted script sources (which can break legitimate inline scripts if not inventoried first), and mark session cookies HttpOnly and SameSite=Lax/Strict to limit cookie theft if a payload executes. A web application firewall rule blocking script patterns in the 'nomCompetidor' field can provide interim protection but is easily bypassed with encoding tricks and must not be treated as a substitute for patching.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79, improper neutralization of user-supplied input during web page generation, in a web application identified as Repasat (endpoint path '/es/' indicates a Spanish-language deployment). The 'nomCompetidor' (competitor name) form field handled by '/es/competitors/store' does not adequately encode or validate attacker-controlled input before it is written into a page response, so markup and script tags submitted by one user are rendered and executed in the context of another user's browsing session. Because the payload is associated with a stored request (the 'store' action), this behaves as a stored/reflected XSS pattern typical of CRUD form endpoints that persist a label and later re-display it. The assessed scope change (S:C in our CVSS 3.1 vector) reflects that the script executes with the origin's privileges in the victim's browser, but confidentiality and integrity impact remain Low (C:L/I:L), with no availability impact and no server-side code execution demonstrated. The CVSS 4.0 vector supplied by the vendor rates PR:L/UI:A, consistent with a low-privilege authenticated user crafting the payload and a distinct victim actively viewing the affected view.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated injection (PR:L) with required victim interaction (UI:R); XSS executes in the victim's browser context so S:C, with low C/I and no availability impact.
Primary rating from Vendor (incibe).
CVSS VectorVendor: incibe
DescriptionCVE.org
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected - endpoint “/es/competitors/store”.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB