Video Library Of The Regional Parliament Of Castile La Mancha
Monthly
Reflected cross-site scripting (CWE-79) in the video library web application of the Castile-La Mancha Regional Parliament allows remote, unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when the victim interacts with attacker-crafted content or a crafted URL (CVSS 4.0 base 5.1, Medium). The application embeds user-supplied content into the page without sanitising it before rendering, so the payload executes in the security context of the site; because the flaw is reflected there is no stored payload and each victim must be individually lured, which is the main limiting factor. Impact is bounded to Low confidentiality and integrity within the browser session of users of this single, narrowly deployed application. No public exploit has been identified at time of analysis and there is no CISA KEV entry; the priority label assigned by vuln.today is this_month.
Reflected cross-site scripting (CWE-79) in the video library web application of the Castile-La Mancha Regional Parliament allows remote, unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when the victim interacts with attacker-crafted content or a crafted URL (CVSS 4.0 base 5.1, Medium). The application embeds user-supplied content into the page without sanitising it before rendering, so the payload executes in the security context of the site; because the flaw is reflected there is no stored payload and each victim must be individually lured, which is the main limiting factor. Impact is bounded to Low confidentiality and integrity within the browser session of users of this single, narrowly deployed application. No public exploit has been identified at time of analysis and there is no CISA KEV entry; the priority label assigned by vuln.today is this_month.