A vulnerability exists in an unknown function of the Calendar component of WebSystems WebTOTUM 2026 that allows malicious input to be reflected and executed as script in the victim’s browser. As an injection flaw, it is classified as CWE‑79 and CWE‑94. The flaw can lead to the execution of arbitrary client‑side code, potentially exposing user credentials, session tokens, or enabling drive‑by attacks if the victim visits a crafted URL or page.

Only the WebSystems WebTOTUM 2026 product is affected, specifically the Calendar feature. No additional version range is listed, so all installed instances of the 2026 release are considered vulnerable.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not published, and the issue is not listed in CISA KEV, so there is no evidence of mass exploitation yet. However, the exploit has been publicly disclosed and a fixed version has been issued by the vendor, implying that remote attackers could readily use the flaw if the system is not patched. The attack vector is inferred to be remote, as the description states that the attack may be initiated remotely and that the publicly disclosed exploit can be used.