CVE-2026-103377: Reflected cross-site scripting in the video library of the Regional Parliament of Castile-La Mancha

Severity: medium (CVSS 5.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-26 · updated 2026-10-26
Weakness: CWE-79

Description

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament’s video library. The application embeds user-supplied content into the page without properly sanitising it before it is rendered by the browser. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary JavaScript code in the browser of a victim who interacts with the content crafted for the attack.

Affected products

Regional Parliament of Castile-La Mancha Video library of the Regional Parliament of Castile-La Mancha: before October 2026 — fixed in October 2026

How to fix

Upgrade to a fixed version: Regional Parliament of Castile-La Mancha Video library of the Regional Parliament of Castile-La Mancha October 2026. Check the vendor advisory for mitigations.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-video-library-regional-parliament-castile

Get alerted when CVE-2026-103377 or the next vulnerability affects your stack