Repasat Application
Monthly
Stored/reflected cross-site scripting in the Repasat application lets an authenticated low-privileged user inject a script payload through the 'nomTamano' parameter submitted to the '/es/companysizebills/store' endpoint, and that payload then executes in the browser of any user who later renders the affected page. Exploitation requires an authenticated session (CVSS 4.0 PR:L) plus a second victim performing user interaction (UI:A), which keeps impact confined to the victim's browser session inside Repasat rather than the underlying server or other systems. CVSS 4.0 base score is 4.8 (medium); no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and no EPSS signal was supplied with the source data.
Stored/reflected cross-site scripting in the Repasat application allows an attacker holding valid low-privilege credentials to inject arbitrary script through the 'nomTamano' parameter at the '/es/companysizemployees/update' endpoint, which then executes in the browser of a user who loads the affected page. The flaw is rated 4.8 (Medium) by the vendor/INCIBE under CVSS 4.0 and requires an authenticated session (CVSS PR:L) plus active victim interaction (UI:A); there is no public exploit identified at time of analysis and the CVE is not reported as confirmed actively exploited (CISA KEV). Impact is confined to the victim's browser context - no server-side code execution, no loss of confidentiality or integrity at the server, and no availability impact.
Authenticated attackers with low privileges can inject malicious scripts into the Repasat application's '/es/origins/store' endpoint via the 'nomOrigen' parameter, resulting in stored or reflected cross-site scripting (CWE-79) that executes when a victim user loads a page rendering the injected payload. Rated CVSS 4.0 4.8 (Medium), exploitation requires both an authenticated account and active user interaction, and no public exploit code has been identified at time of analysis. INCIBE published an advisory for this flaw.
Stored cross-site scripting in the Repasat application allows an authenticated, low-privileged user to inject script content through the 'nomCompetidor' parameter processed at the '/es/competitors/store' endpoint, where the value is persisted and later rendered to other users. Payload execution happens in the victim's browser session once that page is viewed, yielding limited confidentiality and integrity impact confined to the browser context with no direct server compromise; successful exploitation requires both a valid low-privileged account (CVSS vector PR:L) and victim interaction (UI:A/UI:R). No public exploit code has been identified at time of analysis, and no vendor-released patch is documented in the available intelligence, making this a genuine but low-to-moderate priority issue rather than an emergency; the primary reference is the INCIBE advisory covering multiple Repasat application vulnerabilities.
Cross-site scripting in the Repasat application lets an authenticated low-privileged user inject script payloads through the 'nomRuta' parameter of the /es/routes/update/693 route-update endpoint, which then execute in the browser of any victim who loads the affected page. Exploitation requires two prerequisites - a valid low-privilege account (CVSS PR:L) and victim interaction with the crafted content (UI:A) - and the resulting impact is confined to the victim's browser session, such as session or token theft and actions performed as the victim, rather than compromise of the server host. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; the issue rates as a medium-to-low priority rather than an urgent one.
Stored/reflected cross-site scripting in the Repasat application (CWE-79) lets an attacker with a valid account and carrier-management privileges inject arbitrary script into the 'nomTransportista' parameter submitted to the '/es/carriers/update' endpoint, which then executes in the browser of any user who views the page rendering that carrier name. Exploitation is bounded by two prerequisites: the attacker must be authenticated with sufficient rights to submit the carrier-update form (CVSS vector PR:L), and the victim must actively interact with the affected view (UI:A), so impact is confined to the victim's browser session rather than the server (scope-confined C:L/I:L per the independent assessment). Severity is medium (CVSS 4.0 base 4.8; 3.1 assessment AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; no EPSS score was provided in the source data.
Stored cross-site scripting in the Repasat application lets an authenticated user with access to the geozone editing function inject script through the 'nomZonaGeo' parameter at '/es/geozones/update/149979', which executes in a victim's browser when the affected page is rendered. Exploitation requires a valid account (CVSS PR:L) and victim interaction (UI:A), so impact is confined to the victim's browser session rather than the server; no public exploit code and no active exploitation were identified at time of analysis. The vendor-reported CVSS 4.0 score is 4.8, and our assessed CVSS 3.1 vector (S:C/C:L/I:L/A:N) keeps this at medium severity with low real-world priority.
Cross-site scripting in the Repasat application lets an authenticated low-privilege user inject script through the 'nomTipoCli' parameter handled by the /es/clientypes/update/109441 endpoint, with the payload running in the browser of any victim who subsequently views the affected client-type content. Exploitation requires both a valid low-privilege session and a victim who actively interacts with the crafted page, and the impact is confined to that browser context (no availability impact and no cross-system scope), which is why the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N yields a Medium severity (4.8 under CVSS 4.0). No public exploit code and no confirmed active exploitation were identified at time of analysis, and every Repasat build below the vendor's 'Abril' patch (20260402) is affected.
Authenticated cross-site scripting in the Repasat application allows low-privileged users to inject malicious scripts via the 'nomGrupoEmpresarial' parameter, which execute in a victim's browser when they view the affected corporate group update page at /es/corporategroups/update/246. Exploitation requires a valid account with access to the corporate groups update function and active interaction from a victim user; the impact is limited to client-side script execution with no server compromise or availability effect. This medium-severity flaw (CVSS 4.0 base score 4.8) has no public exploit code or confirmed active exploitation identified at time of analysis.
Cross-site scripting in the Repasat application allows an authenticated low-privileged user to inject script that executes in a second, logged-in victim's browser when they load the affected '/es/datatables/getemployeetypesdatatable' endpoint, enabling session token theft and actions performed as the victim. Exploitation is not a drive-by: it requires a valid low-privileged account (CVSS vector PR:L) plus victim interaction (UI:A), and the impact is confined to the client-side browser context with no server-side code execution and no availability impact. Scored 4.8 (Medium) under CVSS 4.0, the flaw carries no CISA KEV listing and no public exploit code was identified at time of analysis, so treat it as a real but precondition-heavy weakness rather than an imminent mass-exploitation risk.
Cross-site scripting in the Repasat application lets an authenticated attacker inject script through the 'nomListaValidacion' parameter processed by the /es/validationslists/assignList/Employee/45659 endpoint, so that a logged-in victim who renders or submits the crafted content executes arbitrary JavaScript in their own browser session. Affected deployments are those exposing the Repasat web application and its validation-list assignment functionality, tracked generically by the CPE cpe:2.3:a:repasat:repasat_application (all versions, no version range published). Exploitation is not unauthenticated and not non-interactive: it requires a valid session plus victim interaction, and the independent assessment rates this as medium severity (CVSS 4.0 base 4.8; CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and the flaw has not been confirmed actively exploited (CISA KEV).
Stored cross-site scripting in the Repasat application allows an authenticated user with low-level privileges to inject arbitrary script through the 'name' parameter of the /es/attachmenttypes/update/{id} endpoint, which then executes in the browser of any user who renders the affected attachment-type record. The INCIBE advisory (EUVD-2026-91319) scores it 4.8 under CVSS 4.0; our independent review maps it to CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, i.e. an authenticated, interaction-dependent issue whose impact stays inside the victim's browser and does not extend to server compromise. No public exploit identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so this is a low-to-moderate priority issue rather than a top-tier threat, affecting all Repasat versions prior to the 'Abril' patch (build 20260402).
Stored/reflected cross-site scripting in the Repasat application lets an authenticated low-privileged user inject a script payload through the 'nomTamano' parameter submitted to the '/es/companysizebills/store' endpoint, and that payload then executes in the browser of any user who later renders the affected page. Exploitation requires an authenticated session (CVSS 4.0 PR:L) plus a second victim performing user interaction (UI:A), which keeps impact confined to the victim's browser session inside Repasat rather than the underlying server or other systems. CVSS 4.0 base score is 4.8 (medium); no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and no EPSS signal was supplied with the source data.
Stored/reflected cross-site scripting in the Repasat application allows an attacker holding valid low-privilege credentials to inject arbitrary script through the 'nomTamano' parameter at the '/es/companysizemployees/update' endpoint, which then executes in the browser of a user who loads the affected page. The flaw is rated 4.8 (Medium) by the vendor/INCIBE under CVSS 4.0 and requires an authenticated session (CVSS PR:L) plus active victim interaction (UI:A); there is no public exploit identified at time of analysis and the CVE is not reported as confirmed actively exploited (CISA KEV). Impact is confined to the victim's browser context - no server-side code execution, no loss of confidentiality or integrity at the server, and no availability impact.
Authenticated attackers with low privileges can inject malicious scripts into the Repasat application's '/es/origins/store' endpoint via the 'nomOrigen' parameter, resulting in stored or reflected cross-site scripting (CWE-79) that executes when a victim user loads a page rendering the injected payload. Rated CVSS 4.0 4.8 (Medium), exploitation requires both an authenticated account and active user interaction, and no public exploit code has been identified at time of analysis. INCIBE published an advisory for this flaw.
Stored cross-site scripting in the Repasat application allows an authenticated, low-privileged user to inject script content through the 'nomCompetidor' parameter processed at the '/es/competitors/store' endpoint, where the value is persisted and later rendered to other users. Payload execution happens in the victim's browser session once that page is viewed, yielding limited confidentiality and integrity impact confined to the browser context with no direct server compromise; successful exploitation requires both a valid low-privileged account (CVSS vector PR:L) and victim interaction (UI:A/UI:R). No public exploit code has been identified at time of analysis, and no vendor-released patch is documented in the available intelligence, making this a genuine but low-to-moderate priority issue rather than an emergency; the primary reference is the INCIBE advisory covering multiple Repasat application vulnerabilities.
Cross-site scripting in the Repasat application lets an authenticated low-privileged user inject script payloads through the 'nomRuta' parameter of the /es/routes/update/693 route-update endpoint, which then execute in the browser of any victim who loads the affected page. Exploitation requires two prerequisites - a valid low-privilege account (CVSS PR:L) and victim interaction with the crafted content (UI:A) - and the resulting impact is confined to the victim's browser session, such as session or token theft and actions performed as the victim, rather than compromise of the server host. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; the issue rates as a medium-to-low priority rather than an urgent one.
Stored/reflected cross-site scripting in the Repasat application (CWE-79) lets an attacker with a valid account and carrier-management privileges inject arbitrary script into the 'nomTransportista' parameter submitted to the '/es/carriers/update' endpoint, which then executes in the browser of any user who views the page rendering that carrier name. Exploitation is bounded by two prerequisites: the attacker must be authenticated with sufficient rights to submit the carrier-update form (CVSS vector PR:L), and the victim must actively interact with the affected view (UI:A), so impact is confined to the victim's browser session rather than the server (scope-confined C:L/I:L per the independent assessment). Severity is medium (CVSS 4.0 base 4.8; 3.1 assessment AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; no EPSS score was provided in the source data.
Stored cross-site scripting in the Repasat application lets an authenticated user with access to the geozone editing function inject script through the 'nomZonaGeo' parameter at '/es/geozones/update/149979', which executes in a victim's browser when the affected page is rendered. Exploitation requires a valid account (CVSS PR:L) and victim interaction (UI:A), so impact is confined to the victim's browser session rather than the server; no public exploit code and no active exploitation were identified at time of analysis. The vendor-reported CVSS 4.0 score is 4.8, and our assessed CVSS 3.1 vector (S:C/C:L/I:L/A:N) keeps this at medium severity with low real-world priority.
Cross-site scripting in the Repasat application lets an authenticated low-privilege user inject script through the 'nomTipoCli' parameter handled by the /es/clientypes/update/109441 endpoint, with the payload running in the browser of any victim who subsequently views the affected client-type content. Exploitation requires both a valid low-privilege session and a victim who actively interacts with the crafted page, and the impact is confined to that browser context (no availability impact and no cross-system scope), which is why the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N yields a Medium severity (4.8 under CVSS 4.0). No public exploit code and no confirmed active exploitation were identified at time of analysis, and every Repasat build below the vendor's 'Abril' patch (20260402) is affected.
Authenticated cross-site scripting in the Repasat application allows low-privileged users to inject malicious scripts via the 'nomGrupoEmpresarial' parameter, which execute in a victim's browser when they view the affected corporate group update page at /es/corporategroups/update/246. Exploitation requires a valid account with access to the corporate groups update function and active interaction from a victim user; the impact is limited to client-side script execution with no server compromise or availability effect. This medium-severity flaw (CVSS 4.0 base score 4.8) has no public exploit code or confirmed active exploitation identified at time of analysis.
Cross-site scripting in the Repasat application allows an authenticated low-privileged user to inject script that executes in a second, logged-in victim's browser when they load the affected '/es/datatables/getemployeetypesdatatable' endpoint, enabling session token theft and actions performed as the victim. Exploitation is not a drive-by: it requires a valid low-privileged account (CVSS vector PR:L) plus victim interaction (UI:A), and the impact is confined to the client-side browser context with no server-side code execution and no availability impact. Scored 4.8 (Medium) under CVSS 4.0, the flaw carries no CISA KEV listing and no public exploit code was identified at time of analysis, so treat it as a real but precondition-heavy weakness rather than an imminent mass-exploitation risk.
Cross-site scripting in the Repasat application lets an authenticated attacker inject script through the 'nomListaValidacion' parameter processed by the /es/validationslists/assignList/Employee/45659 endpoint, so that a logged-in victim who renders or submits the crafted content executes arbitrary JavaScript in their own browser session. Affected deployments are those exposing the Repasat web application and its validation-list assignment functionality, tracked generically by the CPE cpe:2.3:a:repasat:repasat_application (all versions, no version range published). Exploitation is not unauthenticated and not non-interactive: it requires a valid session plus victim interaction, and the independent assessment rates this as medium severity (CVSS 4.0 base 4.8; CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and the flaw has not been confirmed actively exploited (CISA KEV).
Stored cross-site scripting in the Repasat application allows an authenticated user with low-level privileges to inject arbitrary script through the 'name' parameter of the /es/attachmenttypes/update/{id} endpoint, which then executes in the browser of any user who renders the affected attachment-type record. The INCIBE advisory (EUVD-2026-91319) scores it 4.8 under CVSS 4.0; our independent review maps it to CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, i.e. an authenticated, interaction-dependent issue whose impact stays inside the victim's browser and does not extend to server compromise. No public exploit identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so this is a low-to-moderate priority issue rather than a top-tier threat, affecting all Repasat versions prior to the 'Abril' patch (build 20260402).