Severity by source
Network-delivered stored XSS requiring authenticated attacker (PR:L) and victim browser interaction (UI:R); scope change to victim's origin context justifies S:C with high C/I and limited A impact.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
2Description PRE-NVD
AnalysisAI
Stored cross-site scripting in NethServer's WebTop calendar component (versions 1.5.6 and earlier) permits an authenticated attacker to inject malicious JavaScript into calendar event fields, which silently executes in the browser of any user who subsequently views the poisoned event. The impact scope includes session hijacking, unauthorized access to emails, contacts, and files, and the ability to perform actions as the victim within the platform - all without the victim taking any action beyond viewing the event. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, low-privilege authenticated account on the NethServer WebTop platform (confirmed by PR:L in the CVSS 4.0 vector) with sufficient rights to create or edit calendar events in the WebTop calendar component. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (High) is anchored by VC:H/VI:H/VA:H on the vulnerable system and SC:L/SI:L/SA:L on subsequent systems, reflecting that successful exploitation yields substantial impact to the victim's session and data but limited lateral propagation beyond the WebTop platform. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated WebTop user - such as a disgruntled employee or an attacker who has phished a valid account - creates a shared calendar event and embeds a JavaScript payload (e.g., a script that exfiltrates document.cookie to an attacker-controlled server) in the event title or description field. When a higher-privileged colleague, such as a platform administrator, opens their calendar and views the event, the payload fires in their browser, sending their session token to the attacker who then hijacks the session. … |
| Remediation | Upgrade the WebTop module to version 1.5.7, which resolves both CVE-2026-78331 and the related CVE-2026-78332 per the vendor GitHub Security Advisory (GHSA-cqcv-5f3w-wpmr at https://github.com/NethServer/ns8-webtop/security/advisories/GHSA-cqcv-5f3w-wpmr) and INCIBE advisory INCIBE-2026-578 (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-nethserver). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all NethServer WebTop deployments and document current versions to assess exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today