A reflected cross‑site scripting vulnerability exists in reportico-web, versions 8.1.0 and earlier. By supplying a crafted value in the loadTemplate parameter together with execute_mode=PREPARE to run.php, an attacker can cause a victim’s browser to run arbitrary JavaScript. The flaw originates from unsanitized user input being returned in the HTTP response, allowing injection of executable code. This provides attackers with the ability to steal session cookies, deface web pages, or redirect users to malicious sites, thereby compromising confidentiality, integrity, and availability of the affected web application.

The vulnerability affects installations of Reportico Web up to and including version 8.1.0. Systems running newer versions that no longer expose the vulnerable loadTemplate parameter or that properly sanitize the input are not impacted.

The vulnerability is a typical reflected XSS, which is well understood and can be exploited by anyone who can influence the loadTemplate parameter. The EPSS score is not available, and the flaw is not currently listed in the CISA KEV catalog. Despite the lack of exploitation statistics, the nature of XSS means that attackers can compromise any user who visits a crafted URL, making the risk moderate to high in environments where exposed URLs can be accessed by untrusted actors.