Reflected cross-site scripting in the video library of the Regional Parliament of Castile-La Mancha
Web application for the video library of the Regional Parliament of Castile-La Mancha, available at http://videoteca.cortesclm.es/.
INCIBE has coordinated the disclosure of a medium severity vulnerability affecting the web application for the Castile-La Mancha Regional Parliament’s video library. The vulnerability was discovered by Sergio Ros Montero.
The CVSS v4.0 base score, the vector and the CWE vulnerability type are as follows:
- CVE-2026-103377: CVSS v4.0: 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | CWE-79
The vulnerability was fixed by the team at the Castile-La Mancha Regional Parliament in October 2026.
CVE-2026-103377: a reflected Cross-Site Scripting (XSS) vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament’s video library. The application embeds user-supplied content into the page without properly sanitising it before it is rendered by the browser. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary JavaScript code in the browser of a victim who interacts with the content crafted for the attack.
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-103377 | Media | No | Cortes de Castilla-La Mancha |
