CVE-2026-52606

Deferred Deferred - Pending Action

Reflected XSS in Reportico Web via loadTemplate Parameter

Publication date: 2026-08-18

Last updated on: 2026-08-31

Assigner: MITRE

Description

A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the execute_mode=PREPARE parameter of run.php.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-31

Generated

2026-09-08

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-07

NVD

CVE-2026-52606

EUVD

EUVD-2026-61095

Affected Vendors & Products

Vendor	Product	Version / Range
reportico	reportico	to 8.1.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in reportico-web versions 8.1.0 and earlier. It allows remote attackers to inject and execute arbitrary JavaScript code in a victim's web browser by exploiting the loadTemplate parameter combined with execute_mode=PREPARE in run.php.

Detection Guidance

Check if your Reportico version is 8.1.0 or earlier by inspecting the software version or changelog. Test for the vulnerability by accessing a URL like http://target/reportico/run.php?loadTemplate=%3Cscript%3Ealert(document.domain)%3C/script%3E&execute_mode=PREPARE. If the browser executes the script, the system is vulnerable.

Use tools like curl to send a crafted request: curl 'http://target/reportico/run.php?loadTemplate=%3Cscript%3Ealert(1)%3C/script%3E&execute_mode=PREPARE'. Monitor for JavaScript execution in browser responses.

Impact Analysis

An attacker could trick you into clicking a malicious link, which would execute arbitrary JavaScript in your browser. This could lead to session hijacking, theft of cookies or sensitive data, or redirection to malicious sites.

Compliance Impact

This reflected XSS vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized script execution in user browsers. It may lead to data theft, session hijacking, or manipulation of sensitive information, which are critical risks under these regulations.

Mitigation Strategies

Upgrade Reportico to a version later than 8.1.0 where the vulnerability is patched. If upgrading is not possible, disable the loadTemplate parameter in run.php or restrict access to the run.php file via server configuration.

Implement input validation and output encoding for all user-supplied parameters. Use Content Security Policy (CSP) headers to mitigate XSS impact. Regularly audit and monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-52606. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70