EUVD-2026-91370
GHSA-qj83-rwv8-wp2g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliveryInject script via 'nomTamano' at /es/companysizebills/store
-
ExploitPayload stored/reflected unsanitized
-
ExecutionVictim loads affected page
-
PersistScript executes in victim browser
-
ImpactHijack session or act as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session with at least low privileges (PR:L) sufficient to submit the 'nomTamano' parameter to the '/es/companysizebills/store' endpoint, and it requires a second victim user to subsequently render the injected content (UI:A) for the payload to execute. These two factors - mandatory authentication and required victim interaction - are the key limiting conditions and confine impact to the victim's browser context within the Repasat application; there is no indication of unauthenticated or no-interaction exploitation, and impact does not extend to other systems (no scope change). |
| Impact | This is a stored/reflected Cross-Site Scripting flaw (CWE-79) in the Repasat application, rated CVSS 4.0 base score 4.8 (medium). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) indicates network-reachable, low-complexity exploitation that nonetheless requires BOTH authenticated access (PR:L) and active victim interaction (UI:A), which materially lowers real-world urgency versus an unauthenticated drive-by XSS. No EPSS score, KEV listing, or POC was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation - consistent with a newly disclosed INCIBE advisory rather than an attacker-prioritized bug. The impact is limited to the browser context (confidentiality/integrity 'Low', no availability impact, no scope change to other systems per SC/SI/SA:N). Note a conflict in the metadata: the Tags include 'RCE' and the description phrase 'execute arbitrary code' is browser-side script execution, NOT server remote code execution - do not treat this as RCE. Overall this is a genuine but modest, authentication-gated input-validation issue appropriate for routine patching, not an emergency. |
| Exploit ScenarioDerived | An authenticated attacker with low-privilege access submits a crafted payload in the 'nomTamano' parameter to the /es/companysizebills/store endpoint, which is stored or reflected without proper output encoding. When another authenticated user (e.g., an administrator) views the affected page, the injected JavaScript executes in their browser, enabling session token theft or actions performed as the victim. No public exploit code was provided; successful exploitation depends on luring or waiting for a victim to render the malicious content (UI:A). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Stored/reflected cross-site scripting in the Repasat application lets an authenticated low-privileged user inject a script payload through the 'nomTamano' parameter submitted to the '/es/companysizebills/store' endpoint, and that payload then executes in the browser of any user who later renders the affected page. Exploitation requires an authenticated session (CVSS 4.0 PR:L) plus a second victim performing user interaction (UI:A), which keeps impact confined to the victim's browser session inside Repasat rather than the underlying server or other systems. CVSS 4.0 base score is 4.8 (medium); no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and no EPSS signal was supplied with the source data.
RemediationAI
No vendor-released patch identified at time of analysis; version-specific fixes were not supplied in the available data, so the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application should be monitored for the vendor's fixed build and upgrade instructions. Until a patch is available, apply compensating controls on the Repasat application: enforce server-side output encoding and contextual escaping for the 'nomTamano' parameter and all other user-supplied fields rendered on the '/es/companysizebills/store' page, and validate/reject markup characters on input, since both measures break the injection at the source but require code changes and testing that may alter display of legitimate size labels. Deploy a Content-Security-Policy on the Repasat origin that disallows inline and third-party script execution, which stops most XSS payloads from running but can break inline JavaScript used by the application's own UI and must be rolled out in report-only mode first. Because exploitation requires an authenticated low-privileged session, restrict write access to the affected endpoint to the minimum set of roles that genuinely need it, enforce short session lifetimes and HttpOnly/Secure cookie flags so any injected script cannot trivially steal session material, and monitor application logs for anomalous submissions to '/es/companysizebills/store'. Organizations unable to modify the application should restrict network access to the Repasat instance to trusted internal users via VPN or access proxy, accepting the operational trade-off of reduced external availability.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. cross-site scripting) in the Repasat web application. The vulnerable surface is the 'nomTamano' parameter handled by the endpoint '/es/companysizebills/store', which stores or reflects user-supplied input without adequate output encoding or contextual escaping, allowing attacker-controlled markup to be interpreted by the browser as executable script. The supplied CPE 'cpe:2.3:a:repasat:repasat_application:*:*:*:*:*:*:*:*' uses a wildcard version field, so the advisory does not narrow the defect to a specific release and all builds of the Repasat application should be treated as potentially affected until the vendor confirms a fixed build. The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N describes a network-reachable, low-complexity issue requiring low privileges and active user participation, with only low confidentiality and integrity impact and no availability impact; the independent assessment mirrors this with CVSS 3.1 AV:N/AC:L/PR:L/UI:R and confirms the two limiting prerequisites - a valid low-privileged session to write the payload, and a second user to trigger execution. Because execution occurs in the victim's browser context, session cookies, tokens, or in-page data reachable from that origin are the realistic targets; the low-privilege write requirement and required victim interaction materially reduce severity relative to an unauthenticated XSS. The 'RCE' tag attached in the source metadata should be read as referring to client-side script execution rather than server-side remote code execution, which is not supported by the provided vector or assessment.
Know when Repasat Application gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated user can inject (PR:L), victim must render the payload (UI:R), and XSS crosses into the victim's browser context (S:C) with limited C/I impact and no availability loss.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
DescriptionCVE.org
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected - endpoint “/es/companysizebills/store”.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Repasat Application
View allStored cross-site scripting in the Repasat application allows an authenticated, low-privileged user to inject script con
Cross-site scripting in the Repasat application lets an authenticated low-privileged user inject script payloads through
Stored/reflected cross-site scripting in the Repasat application (CWE-79) lets an attacker with a valid account and carr
Stored cross-site scripting in the Repasat application lets an authenticated user with access to the geozone editing fun
Cross-site scripting in the Repasat application lets an authenticated low-privilege user inject script through the 'nomT
Authenticated cross-site scripting in the Repasat application allows low-privileged users to inject malicious scripts vi
Stored cross-site scripting in the Repasat application allows an authenticated user with low-level privileges to inject
Cross-site scripting in the Repasat application allows an authenticated low-privileged user to inject script that execut
Cross-site scripting in the Repasat application lets an authenticated attacker inject script through the 'nomListaValida
Stored/reflected cross-site scripting in the Repasat application allows an attacker holding valid low-privilege credenti
Authenticated attackers with low privileges can inject malicious scripts into the Repasat application's '/es/origins/sto
Exploit-DB