Castile-La Mancha Video Library EUVD-2026-109684

Exploitation requires the attacker to craft content/a URL carrying a JavaScript payload for the Regional Parliament of Castile-La Mancha video library web application and to induce a victim to interact with it (UI:A) - the flaw is reflected, so there is no persistent payload and each victim must be individually lured, which is the primary limiting factor. No attacker authentication is required (PR:N) and the vector is network-reachable. The exact injection point (which input field, parameter, or endpoint reflects the unsanitised content) is not described in the available sources. Impact is bounded to Low confidentiality and integrity in the browser context of users of this single, narrowly deployed application.

This is a reflected Cross-Site Scripting flaw (CWE-79) carrying a CVSS 4.0 base score of 5.1 (Medium). The supplied 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) shows network reach, low complexity, no attacker authentication (PR:N), but required victim interaction (UI:A) and only Low confidentiality/integrity impact on both the vulnerable and a subsequent system. No EPSS score was provided, the CVE is not listed in CISA KEV, and the single reference is the INCIBE advisory rather than any exploit code, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' - a routine remediation priority, not act_now or emergency. Weighing these signals together, this is a genuine but modest issue: real-world risk is constrained by the need to lure a victim into interacting with attacker-crafted content and by the limited (Low) impact, and it is further bounded by the extremely narrow deployment footprint of the single affected application. It is a schedule-and-patch item, not an urgent priority. Reflected (not stored) XSS means each victim must be individually enticed, which limits scale.

An attacker crafts a URL or content payload for the Castile-La Mancha Regional Parliament video library that embeds malicious JavaScript into a reflected response, then sends it to a victim (for example via a phishing link). When the victim opens the crafted link, their browser renders the unsanitised content and executes the attacker's script in the context of the site, enabling session or UI manipulation within that application. No public exploit code was identified in the provided data; the single reference is the INCIBE advisory.