CVE-2026-52609: XSS
A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reporticocriteria parameter in conjunction with the executemode=CRITERIA parameter of run.php.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users who can be induced to open a crafted run.php request with execute_mode=CRITERIA are exposed, because the payload executes in their browser. The issue is remotely exploitable through the reportico_criteria parameter.
What does an attacker need to exploit this issue?
An attacker needs to provide a malicious value in reportico_criteria and use it together with execute_mode=CRITERIA in a request to run.php. Successful exploitation also requires a user’s browser to process the crafted request.
Which versions and configurations are known to be affected?
Versions of reportico-web through 8.1.0 are identified as affected. The available information does not state whether a particular deployment or configuration is required beyond the affected run.php criteria execution mode.