Description
A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the execute_mode=PREPARE parameter of run.php.
Published: 2026-08-18
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A reflected cross‑site scripting vulnerability exists in Reportico Web versions 8.1.0 and earlier. By supplying a malicious payload in the loadTemplate parameter together with execute_mode=PREPARE to run.php, an attacker can cause a victim’s browser to execute arbitrary JavaScript.

Affected Systems

The vulnerability affects installations of Reportico Web up to and including version 8.1.0. Systems running newer versions that no longer expose the vulnerable loadTemplate parameter or that properly sanitize the input are not impacted.

Risk and Exploitability

The CVSS score of 6.1 indicates a moderate severity reflected XSS. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. An attacker can exploit this vulnerability by crafting a URL that includes a malicious loadTemplate value; any user encountering such a URL can have arbitrary JavaScript executed in their browser. The risk is contingent on exposure to untrusted input and the likelihood of users visiting crafted links.

Generated by OpenCVE AI on August 21, 2026 at 18:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Reportico Web to a version newer than 8.1.0 or apply the vendor’s official patch if one becomes available
  • If an upgrade is not immediately possible, block or filter the loadTemplate parameter in web server or application firewall rules so that it cannot be abused
  • Implement a strict Content Security Policy that restricts inline script execution and disallows loading scripts from unknown origins

Generated by OpenCVE AI on August 21, 2026 at 18:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Reportico
Reportico reportico
Vendors & Products Reportico
Reportico reportico

Fri, 21 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Title Reflected XSS via loadTemplate in Reportico Web 8.1.0 and earlier

Tue, 18 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Title Reflected XSS via loadTemplate in Reportico Web 8.1.0 and earlier
Weaknesses CWE-79

Tue, 18 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Description A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the execute_mode=PREPARE parameter of run.php.
References

Subscriptions

Reportico Reportico
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-18T18:51:39.304Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-52606

cve-icon Vulnrichment

Updated: 2026-08-18T18:51:32.491Z

cve-icon NVD

Status : Deferred

Published: 2026-08-18T17:16:59.080

Modified: 2026-08-31T20:12:02.273

Link: CVE-2026-52606

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T21:19:23Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')