CVE-2026-52609
Received Received - Intake

Reflected XSS in Reportico Web

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: MITRE

Description
A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reportico_criteria parameter in conjunction with the execute_mode=CRITERIA parameter of run.php.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-52609
EUVD
EUVD-2026-61096

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
reportico reportico to 8.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in reportico-web versions 8.1.0 and earlier. Attackers can inject malicious JavaScript into a user's browser by sending a crafted payload through the reportico_criteria parameter when the execute_mode=CRITERIA parameter is used in run.php.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to run.php for parameters reportico_criteria and execute_mode=CRITERIA. Check for unusual JavaScript payloads in these parameters. Use browser developer tools to inspect responses for reflected XSS patterns.

Impact Analysis

An attacker could steal session cookies, redirect you to malicious sites, or perform actions on your behalf without your knowledge. This could lead to unauthorized access to sensitive data or account takeover if you interact with a crafted link.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance violations if user data is compromised due to this flaw.

Mitigation Strategies

Immediately update reportico-web to a version beyond 8.1.0. If an update is not available, implement input validation and output encoding for the reportico_criteria parameter. Disable execute_mode=CRITERIA if not required. Monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart