Repasat EUVD-2026-91381

Exploitation requires an authenticated low-privileged account (PR:L) with access to the competitor-creation feature at the '/es/competitors/store' endpoint, where the attacker injects a script into the 'nomCompetidor' parameter. Successful exploitation is gated on victim interaction (UI:A): a second user must view the page rendering the stored value for the payload to execute. Limiting factors are therefore the need for valid credentials and a victim who opens the affected view; impact is confined to the victim's browser context with no direct server compromise.

This is a genuine but low-to-moderate priority issue, not a top-tier emergency. The CVSS 4.0 base score is 4.8 (Medium), and the vector tells a consistent story: AV:N (network reachable) but PR:L (attacker must already hold a low-privileged authenticated account) and UI:A (a victim must actively interact, i.e. view the attacker-planted content). Impact is bounded - VC:L/VI:L and VA:N - reflecting that a Cross-Site Scripting flaw compromises the victim's browser session, not the server. There is no CISA KEV listing, no EPSS score supplied, no SSVC decision data, and no public proof-of-concept referenced, so there is no evidence of active or imminent exploitation; this is no public exploit identified at time of analysis. The combined requirement of valid authentication plus victim interaction meaningfully lowers real-world risk versus the raw 'network' vector. One data caveat: the input Tags assert 'RCE', but both the CWE (CWE-79) and the description ('execute arbitrary code in the victim's browser') describe browser-side script execution, NOT server-side remote code execution - treat the RCE label as incorrect.

An authenticated low-privilege user submits a competitor record through the /es/competitors/store endpoint, injecting a malicious script into the 'nomCompetidor' parameter. When another user (such as an administrator) later views the stored competitor data, the script executes in their browser, enabling session hijacking or actions performed as that victim. No public proof-of-concept is referenced, and exploitation requires the victim to actively view the poisoned content (UI:A).