CVE-2026-103377 PUBLISHED

Reflected cross-site scripting in the video library of the Regional Parliament of Castile-La Mancha

Assigner: INCIBE
Reserved: 30.09.2026 Published: 26.10.2026 Updated: 26.10.2026

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament’s video library. The application embeds user-supplied content into the page without properly sanitising it before it is rendered by the browser. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary JavaScript code in the browser of a victim who interacts with the content crafted for the attack.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS Score: 5.1

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	Low	Confidentiality	Low
Attack Complexity	Low	Integrity	Low	Integrity	Low
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	Active

CVSS 4.0

Product Status

Vendor	Regional Parliament of Castile-La Mancha
Product	Video library of the Regional Parliament of Castile-La Mancha
Versions	Default: unaffected affected from 0 to October 2026 (excl.)

Solutions

The vulnerability was fixed by the team at the Castile-La Mancha Regional Parliament in October 2026.

Credits

Sergio Ros Montero finder

References

https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-video-library-regional-parliament-castile

Problem Types

CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') CWE