EUVD-2026-91384
GHSA-9f7m-h693-mh53
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Repasat with low-privilege account
-
DeliveryInject script via nomTransportista at /es/carriers/update
-
ExploitVictim opens affected carrier record
-
ExecutionPayload executes in victim browser session
-
ImpactHijack session or perform actions as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session with sufficient privileges to submit the carrier-update form at '/es/carriers/update' (PR:L), meaning an attacker needs a valid Repasat account with access to carrier management. The payload is delivered through the 'nomTransportista' parameter, and successful triggering further requires active user interaction (UI:A) - a victim must view or interact with the page rendering the injected carrier name. These two factors - mandatory authentication and required victim interaction - are the primary limits on realistic exploitation; there is no indication of a non-default configuration dependency, and impact is confined to the victim's browser context rather than the underlying server. |
| Impact | This is a medium-severity stored/reflected Cross-Site Scripting flaw (CWE-79) in the Repasat application, injected via the 'nomTransportista' parameter of the '/es/carriers/update' endpoint. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) scores 4.8 and is internally consistent with a typical XSS: network-reachable and low-complexity, but requiring authenticated access (PR:L) and active victim interaction (UI:A), with only low confidentiality and integrity impact and no availability impact. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided, so the real-world signal is: no public exploit identified at time of analysis. Weighing these signals together, this is a genuine but modest-priority issue - the twin gating factors of needing a valid low-privileged account AND tricking a victim into interacting substantially reduce mass-exploitation likelihood, placing it well below a drop-everything priority. Note one data conflict: the input Tags include 'RCE', but the description explicitly scopes code execution to 'the victim's browser,' which is client-side script execution (standard XSS), NOT remote code execution on the server - the RCE tag is misleading and should not drive prioritization. |
| Exploit ScenarioDerived | An authenticated attacker with access to the carrier management feature submits a crafted payload in the 'nomTransportista' (carrier name) field at '/es/carriers/update'. When another Repasat user later views the affected carrier record, the stored script executes in their browser, allowing session hijacking, UI manipulation, or actions performed as the victim. No public exploit code is identified at time of analysis, and successful exploitation depends on an authenticated foothold plus victim interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Stored/reflected cross-site scripting in the Repasat application (CWE-79) lets an attacker with a valid account and carrier-management privileges inject arbitrary script into the 'nomTransportista' parameter submitted to the '/es/carriers/update' endpoint, which then executes in the browser of any user who views the page rendering that carrier name. Exploitation is bounded by two prerequisites: the attacker must be authenticated with sufficient rights to submit the carrier-update form (CVSS vector PR:L), and the victim must actively interact with the affected view (UI:A), so impact is confined to the victim's browser session rather than the server (scope-confined C:L/I:L per the independent assessment). Severity is medium (CVSS 4.0 base 4.8; 3.1 assessment AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; no EPSS score was provided in the source data.
RemediationAI
No vendor-released patch is identified in the available intelligence for CVE-2026-59660; the only authoritative source is the INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application, which should be monitored for a fixed version and applied immediately once published. In the interim, the most effective control is to eliminate the injection at its source: enforce strict server-side allow-list validation (reject characters such as '<', '>', quotes and event-handler syntax) on the 'nomTransportista' field and apply context-aware HTML output encoding whenever the carrier name is rendered, which directly closes the CWE-79 root cause - the trade-off is that aggressive filtering may reject legitimate names containing punctuation or accented characters, so the allow-list must be tuned to the business's real data. Deploying a Content-Security-Policy that disallows inline and untrusted script sources significantly reduces the chance a surviving payload executes, at the cost of possibly breaking legacy inline JavaScript in the application and requiring tuning and reporting-only rollout first. Because exploitation requires PR:L, restrict access to the '/es/carriers/update' endpoint and the carrier-management role to the smallest set of trusted accounts, and audit existing carrier records for stored payloads so previously injected names are cleaned up; this reduces the number of possible injectors but does not protect victims who view already-poisoned data. Setting session cookies with HttpOnly and SameSite attributes limits session hijacking after a payload fires but does not prevent script execution itself, and should be treated only as damage limitation. Finally, since the advisory groups multiple Repasat issues, review the whole notice rather than only this XSS item when planning upgrades.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic Cross-Site Scripting issue (CWE-79) in the Repasat application, where user-supplied input accepted by the carrier-management workflow is rendered back to other users without adequate context-aware output encoding or input sanitisation. The vulnerable sink is the 'nomTransportista' (carrier name) parameter handled by the '/es/carriers/update' endpoint; because carrier names are persisted and later displayed, the flaw can behave as stored XSS - the injection is written once through the update form and then fires for every subsequent viewer of the affected listing, which is what raises the potential victim pool beyond the submitter. The CPE entry cpe:2.3:a:repasat:repasat_application:*:*:*:*:*:*:*:* uses a wildcard version component, indicating that no specific fixed release is enumerated and that all observed versions of the Repasat application fall within scope of the advisory. The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N describes a network-reachable, low-complexity attack with no additional attack requirements that first demands authenticated low-level privileges and then active victim interaction; only low confidentiality and integrity impact are scored on the vulnerable system, with no availability impact and no impact on subsequent systems. The independent 3.1 assessment (S:C, C:L/I:L/A:N) characterises the script as executing in the victim's browser security context, which is a different context from the vulnerable server component, but confirms the damage stays within the browser - there is no evidence of server-side code execution despite the 'RCE' tag attached to this CVE in the source feed, which should be read as 'arbitrary code in the victim's browser' rather than remote code execution on the host. Practical exploitation therefore depends on the injected payload surviving storage or reflection and executing for a target user, with HttpOnly cookie attributes only limiting theft of session material and not the XSS execution itself.
Know when Repasat Application gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated submission of the carrier field gives PR:L; XSS requires a victim to render the payload (UI:R) and crosses into their browser context (S:C) with limited C/I impact and no availability effect.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
DescriptionCVE.org
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTransportista” parameter is affected - endpoint “/es/carriers/update”.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Repasat Application
View allStored cross-site scripting in the Repasat application allows an authenticated, low-privileged user to inject script con
Cross-site scripting in the Repasat application lets an authenticated low-privileged user inject script payloads through
Stored cross-site scripting in the Repasat application lets an authenticated user with access to the geozone editing fun
Cross-site scripting in the Repasat application lets an authenticated low-privilege user inject script through the 'nomT
Authenticated cross-site scripting in the Repasat application allows low-privileged users to inject malicious scripts vi
Stored cross-site scripting in the Repasat application allows an authenticated user with low-level privileges to inject
Cross-site scripting in the Repasat application allows an authenticated low-privileged user to inject script that execut
Cross-site scripting in the Repasat application lets an authenticated attacker inject script through the 'nomListaValida
Stored/reflected cross-site scripting in the Repasat application lets an authenticated low-privileged user inject a scri
Stored/reflected cross-site scripting in the Repasat application allows an attacker holding valid low-privilege credenti
Authenticated attackers with low privileges can inject malicious scripts into the Repasat application's '/es/origins/sto
Exploit-DB