CVE-2026-78331 / CVE-2026-78332: Multiple Vulnerabilities in NethServer

["Intilangelo, Andrea" <andrea () intilangelo it>]

Two stored XSS vulnerabilities have been disclosed in the NethServer WebTop module, affecting versions 1.5.6 and 
earlier.
CVE-2026-78331 (CVSS 4.0: 8.7) affects the calendar component, while CVE-2026-78332 (CVSS 4.0: 8.2) affects the 
contacts component.

Both vulnerabilities allow malicious content to be stored and JavaScript code to be executed when the affected calendar 
event or contact is viewed by another user.

Affected versions:
WebTop <= 1.5.6

Fixed version:
WebTop 1.5.7

Credits:
Vulnerability discovered by Andrea Intilangelo

References:

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-nethserver
https://github.com/NethServer/ns8-webtop/security/advisories/GHSA-cqcv-5f3w-wpmr
https://github.com/NethServer/ns8-webtop/security/advisories/GHSA-7vf9-f3rc-vg3x

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/