CVE-2026-52606: XSS

Q: Which deployments are exposed?

Deployments running reportico-web 8.1.0 or earlier are in scope when run.php is reachable by users whose browsers could be induced to open a crafted request. The vulnerable input is the loadTemplate parameter used together with execute_mode=PREPARE.

Q: What does exploitation require?

An attacker needs to cause a victim to load a crafted run.php request containing a malicious loadTemplate value and execute_mode=PREPARE. The resulting JavaScript executes in the victim's browser.

Published Aug 18, 2026

Updated

A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the executemode=PREPARE parameter of run.php.

Affected Software

0 affected components

Event History

Aug 18, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which deployments are exposed?

Deployments running reportico-web 8.1.0 or earlier are in scope when run.php is reachable by users whose browsers could be induced to open a crafted request. The vulnerable input is the loadTemplate parameter used together with execute_mode=PREPARE.

What does exploitation require?

An attacker needs to cause a victim to load a crafted run.php request containing a malicious loadTemplate value and execute_mode=PREPARE. The resulting JavaScript executes in the victim's browser.