CVE-2026-52606

Name of the Vulnerable Software and Affected Versions reportico-web versions prior to 8.1.1

Description A reflected cross-site scripting (XSS) issue allows remote attackers to execute arbitrary JavaScript in a user's web browser. This occurs when a malicious payload is included in the loadTemplate parameter while using the execute mode=PREPARE parameter at the 'run.php' endpoint.

Recommendations Update reportico-web to a version newer than 8.1.0. As a temporary mitigation, restrict access to the 'run.php' endpoint or avoid using the loadTemplate parameter in conjunction with execute mode=PREPARE.