CVE-2026-103377
Received Received - Intake

Reflected XSS in Castile-La Mancha Regional Parliament Video Library

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament’s video library. The application embeds user-supplied content into the page without properly sanitising it before it is rendered by the browser. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary JavaScript code in the browser of a victim who interacts with the content crafted for the attack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-103377
EUVD
EUVD-2026-109684

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected Cross-Site Scripting (XSS) vulnerability in the Castile-La Mancha Regional Parliament’s video library web application. It occurs when user-supplied content is embedded into a page without proper sanitization, allowing attackers to inject malicious JavaScript code that executes in victims' browsers when they interact with the crafted content.

Detection Guidance

To detect this reflected XSS vulnerability, monitor web application logs for unusual user-supplied input patterns, especially in the video library application. Check for requests containing script tags or JavaScript events. Use browser developer tools to inspect responses for unsanitized user content. Test with payloads like <script>alert(1)</script> in input fields.

Impact Analysis

An attacker could trick you into clicking a malicious link, leading to execution of arbitrary JavaScript in your browser. This may result in theft of session cookies, account takeover, or redirection to phishing sites. The impact depends on your privileges and the sensitivity of data accessible through the application.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face fines or penalties if they fail to address XSS flaws that expose user data.

Mitigation Strategies

Immediately apply input validation and output encoding to sanitize user-supplied content in the video library application. Ensure all dynamic content is properly escaped before rendering. Update the application to the latest patched version provided by the Regional Parliament's team. Monitor for any suspicious activity or exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103377. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart