Repasat EUVD-2026-91385

Exploitation requires an authenticated account in the Repasat application (CVSS PR:L) with access to the geozone update function, and the ability to submit data via the 'nomZonaGeo' parameter at '/es/geozones/update/149979', which fails to sanitize/encode that input. Successful impact further requires active user interaction (UI:A): a victim must load the page rendering the injected 'nomZonaGeo' value for the script to execute. These factors - required authentication, a specific application feature (geozone editing), and dependence on a victim viewing the stored content - meaningfully limit real-world exploitation and confine impact to the victim's browser session rather than the server.

This is a medium-severity authenticated cross-site scripting (CWE-79) flaw and, by every available signal, a low real-world priority rather than an urgent threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) indicates network-reachable but low-complexity exploitation that requires both existing privileges (PR:L, i.e. an authenticated account) and active victim interaction (UI:A), with only Low confidentiality and integrity impact and no availability or subsequent-system impact - consistent with the assigned 4.8 base score. No EPSS probability, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation; per the precision rules this is 'no public exploit identified at time of analysis.' The signals are internally consistent (a scoped, interaction-dependent, privilege-gated web injection), so there is no CVSS-vs-description conflict to resolve. One metadata discrepancy must be stated explicitly: the input carries an 'RCE' tag, but both the description ('arbitrary code in the victim's browser') and CWE-79 describe client-side script execution, NOT server-side remote code execution - the RCE label overstates impact and should be treated as mislabeled.

An attacker who holds a low-privileged authenticated account in the Repasat application submits a malicious payload via the 'nomZonaGeo' parameter to the '/es/geozones/update/149979' endpoint, where it is stored/reflected without proper encoding. When a victim user (potentially a higher-privileged operator) subsequently views the affected geozone, the script executes in their browser, enabling session theft, UI defacement, or actions performed as the victim. No public exploit code is identified at time of analysis, and the attack depends on the victim actually loading the injected content (UI:A).