CVE-2026-52609 in reportico-web
Summary
by MITRE • 08/18/2026
A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reportico_criteria parameter in conjunction with the execute_mode=CRITERIA parameter of run.php.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The identified security flaw resides within Reportico, specifically affecting versions up to 8.1.0, and manifests as a reflected cross-site scripting vulnerability. This type of vulnerability occurs when an application includes unvalidated or unsanitized user-supplied data in its immediate output without proper encoding or escaping mechanisms. In this specific instance, the web application fails to adequately sanitize input provided through the reportico_criteria parameter within the run.php script. The vulnerability is triggered specifically when the execute_mode parameter is set to CRITERIA, which directs the application to process and display user-defined search criteria in a manner that inadvertently executes embedded malicious scripts rather than treating them as plain text data.
From a technical perspective, this flaw represents a classic injection weakness where the boundary between code and data is blurred due to insufficient input validation. When an attacker crafts a URL containing a specially constructed payload within the reportico_criteria parameter, the web server processes the request and reflects the malicious content back in the HTTP response. Because the application does not neutralize special characters or script tags before rendering them in the browser context, the client-side environment interprets the injected JavaScript as executable code. This allows for the execution of arbitrary scripts within the security context of the vulnerable website, effectively granting the attacker control over how that specific page is rendered and processed by the victim's web browser.
The operational impact of this vulnerability is significant, particularly in environments where users with varying levels of trust access the application. An attacker can leverage this flaw to perform session hijacking by stealing sensitive cookies or authentication tokens stored in the user's browser. Furthermore, it enables credential theft through phishing techniques that mimic legitimate login forms within the compromised page context. The attack vector also supports keylogging capabilities, allowing the capture of keystrokes entered into form fields on the affected site. In more advanced scenarios, this vulnerability can serve as a pivot point for further attacks, such as defacing the website or distributing malware by redirecting users to malicious domains that exploit other browser vulnerabilities.
This incident aligns with CWE-79, which categorizes improper neutralization of input during web page generation known as Cross-site Scripting. It also maps directly to MITRE ATT&CK technique T1059, specifically the sub-category for JavaScript execution, and falls under the broader tactic of Execution within the cyber kill chain. The reflected nature of this XSS indicates that it is typically exploited via social engineering or phishing links rather than persistent storage in a database, making prompt detection and user awareness critical components of defense alongside technical mitigations.
To mitigate this vulnerability, immediate patching to a version of Reportico greater than 8.1.0 is the most effective remediation strategy as developers have likely implemented proper input validation and output encoding mechanisms in subsequent releases. In cases where upgrading is not immediately feasible, administrators should implement strict input filtering on the server side to reject or sanitize special characters such as angle brackets, quotes, and ampersands within the reportico_criteria parameter. Additionally, deploying a Web Application Firewall can provide an additional layer of defense by detecting and blocking requests that contain known XSS payload patterns before they reach the application logic. Enabling Content Security Policy headers with strict directives regarding script sources can also limit the impact if any malicious scripts are successfully injected, preventing them from executing unless explicitly allowed by policy.