CVE-2026-6743

Vulnerability

Overview

A stored cross-site scripting (XSS) vulnerability exists in the Calendar component of WebSystems WebTOTUM 2026. The exact manipulation path is not fully disclosed, but the issue allows an attacker to inject malicious scripts through the affected function. The vendor has confirmed the vulnerability and released a patched version [1].

Exploitation

Exploitation requires no special authentication or network position, as the attack may be initiated remotely. The vulnerability has been publicly disclosed, meaning proof-of-concept code is available, lowering the barrier for attackers. Successful exploitation depends on persuading a user to access the crafted calendar content, typically via a link or by viewing the compromised calendar entry.

Impact

An attacker who achieves XSS can execute arbitrary JavaScript in the context of the victim's browser session. This can lead to data theft, session hijacking, or defacement within the WebTOTUM application. The CVSS v3.1 score of 3.5 (Low) reflects the need for user interaction and the limited impact on availability, but confidentiality and integrity are partially affected.

Mitigation

The vendor responded professionally and quickly provided a fixed version of WebTOTUM. Users and administrators are strongly advised to upgrade the affected component as recommended in the official advisory [1]. No workarounds beyond applying the update have been described.