Description

A Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-14T00:16:56.040Z",
  "pubdate": "2026-09-14T00:16:56.040Z",
  "executiveSummary": "A stored Cross-Site Scripting (XSS) vulnerability exists within the web backend of the Repetico application, specifically affecting version 1.9.7.31 for Android.\nThe vulnerability originates from improper neutralization of user-supplied input within the multiple-choice question text field.\nA remote, authenticated attacker can exploit this flaw to inject and execute arbitrary JavaScript code within the context of the victim's application session.\nSuccessful exploitation compromises the integrity and confidentiality of the user's session, potentially allowing unauthorized actions or data exfiltration.\nThe risk is categorized as high, as it enables the execution of malicious scripts in the security context of the application, bypassing intended functional boundaries.\nExploitation requires the attacker to be authenticated to the platform and have the ability to submit or modify content within the multiple-choice question fields.",
  "technicalDetails": "The vulnerability is a stored XSS flaw located in the data processing pipeline of the Repetico 1.9.7.31 Android application's backend web interface. The root cause is the failure of the backend server to perform adequate input validation and output encoding on data submitted via the multiple-choice question text field.\nWhen a user creates or edits a multiple-choice question, the application backend accepts the provided text input and persists it directly into the application database without sufficient sanitization. Subsequently, when this question is rendered in the web-based interface or within the Android application's internal WebView component, the injected script is interpreted and executed by the browser engine as legitimate code.\nThe attack flow proceeds as follows: First, an authenticated attacker crafts a malicious payload containing JavaScript, such as '<script>alert(document.cookie)</script>', and submits it through the multiple-choice question text field. The backend receives this unsanitized input and stores it as part of the question's content. Upon navigating to the view where this question is displayed, the backend serves the stored payload to the victim's client. The client's WebView then parses the malicious script tag and executes the included JavaScript.\nSince the script executes within the application's origin, it possesses access to the application's document object model (DOM), cookies, and session tokens. This enables an attacker to perform unauthorized actions on behalf of the user, steal session identifiers, or modify the displayed content to conduct further social engineering attacks.\nThe vulnerability affects Repetico version 1.9.7.31. Because the script execution occurs within the context of the app's WebView, the payload can potentially interact with the Android application's bridge or internal APIs if they are improperly exposed, significantly expanding the impact beyond standard web-based XSS attacks.\nThis vulnerability requires authenticated access, but because it is a stored XSS, the payload remains persistent across sessions until removed by an administrator or the attacker, posing a recurring risk to any user who views the corrupted question content."
}