EUVD-2026-91377
GHSA-m2wx-5xw3-q4fg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryInject script via nomServicioPrestado at /store
-
ExploitPayload stored in service record
-
ExecutionVictim opens affected page
-
PersistScript executes in victim browser
-
ImpactHijack session / act as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account with privileges to submit data to the /es/providedservices/store endpoint (PR:L), used to inject a malicious payload into the 'nomServicioPrestado' parameter. Because this is stored/persistent XSS, a second victim user must then view the affected service record for the script to execute (UI:A). Limiting factors: attacker needs valid application credentials, the payload only runs against users who open the affected page, and impact is confined to the victim's browser session (no server compromise). |
| Impact | This is a genuinely moderate, not high-priority, issue. The CVSS 4.0 base score of 4.8 (Medium) is consistent with a stored/reflected Cross-Site Scripting flaw (CWE-79): network vector (AV:N) and low complexity (AC:L) are offset by two meaningful constraints - the attacker must already be authenticated (PR:L) and a victim must actively interact with the malicious content (UI:A). Impact is limited to low confidentiality and integrity (VC:L/VI:L) with no availability or scope-change impact. There is no EPSS score, no CISA KEV listing, and no evidence of public exploit code in the provided data, so there is no indication of active or imminent widespread exploitation. One signal conflicts with the technical reality: the input carries an 'RCE' tag, but the description and CWE-79 describe only 'arbitrary code in the victim's browser' - i.e. JavaScript execution via XSS, NOT system-level remote code execution. The 'RCE' label overstates the impact and should be treated with skepticism. Overall: a legitimate but medium-severity bug requiring an authenticated foothold plus victim interaction, not a drop-everything priority. |
| Exploit ScenarioDerived | An authenticated low-privileged user of the Repasat application submits a crafted payload in the 'nomServicioPrestado' parameter to the /es/providedservices/store endpoint, which is stored and later rendered without sanitization. When another user (e.g. an administrator or colleague) views the affected service record, the attacker's script executes in that victim's browser session, enabling session theft or actions on the victim's behalf. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Stored cross-site scripting in the Repasat application lets an authenticated user inject a malicious payload through the 'nomServicioPrestado' parameter submitted to the /es/providedservices/store endpoint, which is then rendered in the browser of any user who opens the affected service record. Because the attacker must hold valid application credentials with permission to create or modify provided-service entries (PR:L) and a separate victim must view the poisoned record for the script to fire (UI:A), exploitation is limited to script execution inside the victim's browser session and does not compromise the server. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied in the source data, and the moderate CVSS 4.0 base of 4.8 reflects the privilege and user-interaction prerequisites.
RemediationAI
No vendor-released patch has been identified at time of analysis, so remediation must initially rely on compensating controls. Treat the INCIBE-CERT advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application) as the authoritative source and request an updated release or hotfix from the vendor; once a fixed build is published, upgrading is the primary fix. In the interim, apply contextual output encoding or HTML sanitization to the 'nomServicioPrestado' field and all other user-supplied values rendered in service records, with the trade-off that aggressive sanitization may strip legitimate formatting from service names. Deploy a web application firewall rule set that decodes and inspects POST bodies destined for /es/providedservices/store and blocks script-bearing payloads, accepting that signature-based filtering can be evaded and may generate false positives on legitimate input. Enforce a strict Content-Security-Policy (for example, script-src 'self' with nonces) to blunt inline script execution, though this requires application-wide testing and can break existing inline scripts. Additionally, restrict write access to provided-service records to the smallest set of trusted staff (since exploitation requires PR:L credentials), monitor for anomalous stored content, and consider rate limiting or approval workflows on the store endpoint, each of which adds administrative friction to normal service-registration operations.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic persistent (stored) cross-site scripting condition, categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation), in a web application that stores service records and later renders them back to users. The vulnerable sink is the 'nomServicioPrestado' field, and the write path is the /es/providedservices/store endpoint, so user-supplied markup is persisted server-side and emitted without adequate encoding or sanitization when the record is displayed. The 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L) and the independent 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) agree that the attacker is network-positioned, already authenticated, and dependent on a victim's interaction, with scope expansion in the 3.1 evaluation capturing impact that extends to the victim's browser origin rather than the server. No CPE identifiers were returned with the advisory data, so the exact affected build, release channel, or deployment variant of Repasat cannot be pinned down from the supplied sources; the 'RCE' tag in the source metadata should be read as referring to arbitrary JavaScript execution in the client, not server-side remote code execution, which the assessed impact (C:L/I:L/A:N) does not support.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated injection gives PR:L, victim viewing gives UI:R, script executing in the victim's browser context yields S:C with low C/I impact and no availability impact.
Primary rating from Vendor (incibe).
CVSS VectorVendor: incibe
DescriptionCVE.org
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomServicioPrestado” parameter is affected - endpoint “/es/providedservices/store”.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB