A reflected cross‑site scripting vulnerability exists in the video library of the Regional Parliament of Castile‑La Mancha. User input supplied for the video content is directly inserted into the rendered page without proper sanitization. When exploited, an attacker can cause arbitrary JavaScript to run in a victim’s browser, enabling client‑side code execution, data theft, or session hijacking.

The affected product is the Video library of the Regional Parliament of Castile‑La Mancha, operated by the Regional Parliament of Castile‑La Mancha. No specific version information is provided in the advisory.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score is not available, suggesting a lower derived likelihood of exploitation but not zero. The vulnerability is not listed in CISA’s KEV database. Based on the nature of reflected XSS, the likely attack vector is a crafted URL or form input that a victim is persuaded to visit or submit; once the victim’s browser renders the malicious script, the attacker can execute arbitrary code. The impact is confined to the victim’s browser session and does not require privileged access to the server.