{"id":"CVE-2026-103377","title":"Reflected cross-site scripting in the video library of the Regional Parliament of Castile-La Mancha","summary":"A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament’s video library. The application embeds user-supplied content into the page without properly san…","severity":"medium","cvss":5.1,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"Regional Parliament of Castile-La Mancha","product":"Video library of the Regional Parliament of Castile-La Mancha","affected":["video_library_of_the_regional_parliament_of_castile-la_mancha < October 2026"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T09:29:50.749Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-103377","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-video-library-regional-parliament-castile"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T10:23:42.838Z","slug":"CVE-2026-103377","body":"## Overview\n\nA reflected Cross-Site Scripting (XSS) vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament’s video library. The application embeds user-supplied content into the page without properly sanitising it before it is rendered by the browser. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary JavaScript code in the browser of a victim who interacts with the content crafted for the attack.\n\n## Affected\n\n- `video_library_of_the_regional_parliament_of_castile-la_mancha < October 2026`\n\n## Remediation\n\nThe vulnerability was fixed by the team at the Castile-La Mancha Regional Parliament in October 2026.","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":28.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}